NDC & PKI

[Day 2] 2. SNORT Setup

D
DITISS Admin
••7 min read

Basic Command Syntax

shell
snort -i 4 -c C:\Snort\etc\snort.conf -l C:\Snort\log -A console

Explanation of Parameters

  • snort
    : Launches SNORT.
  • -i
    : Specifies the interface to use (e.g., 
    4
    is the interface number).
  • -c
    : Specifies the path to the configuration file (e.g., 
    C:\Snort\etc\snort.conf
    ).
  • -l
    : Specifies the path to the log folder (e.g., 
    C:\Snort\log
    ).
  • -A
    : Specifies the alert mode (
    console
    outputs alerts directly to the console).

Location of 
snort.conf

The configuration file is located at:

plaintext
C:\Snort\etc\snort.conf

Common Errors and Their Solutions

1. First Error: 
ipvar

Cause:
The 

ipvar
keyword is used for defining IPv6 variables, but we are using IPv4 which requires the 
var
keyword.

Solution:

  1. Open 
    snort.conf
    and use the find-and-replace function.
  2. Replace all occurrences of 
    ipvar
    with 
    var
    .
  3. Ensure exactly 11 occurrences are replaced.
  4. Save the configuration file and rerun the command.

2. Second Error: 
snort_dynamicpreprocessor

Cause:
The error shows a Linux-style file path for dynamic preprocessors, but we are working on Windows.

Solution:

  1. Navigate to 
    C:\Snort\lib\dynamic_preprocessor
    .
  2. You’ll find 14 files in this folder.
  3. Open 
    snort.conf
    and update the paths to Windows-style paths.
  4. Replace the existing Linux-style paths with the following (around line 248):
plaintext
dynamic_preprocessor C:\Snort\lib\dynamic_preprocessor\sf_dce2.dll
dynamic_preprocessor C:\Snort\lib\dynamic_preprocessor\sf_dnp3.dll
dynamic_preprocessor C:\Snort\lib\dynamic_preprocessor\sf_dns.dll
dynamic_preprocessor C:\Snort\lib\dynamic_preprocessor\sf_ftptelnet.dll
dynamic_preprocessor C:\Snort\lib\dynamic_preprocessor\sf_gtp.dll
dynamic_preprocessor C:\Snort\lib\dynamic_preprocessor\sf_imap.dll
dynamic_preprocessor C:\Snort\lib\dynamic_preprocessor\sf_modbus.dll
dynamic_preprocessor C:\Snort\lib\dynamic_preprocessor\sf_pop.dll
dynamic_preprocessor C:\Snort\lib\dynamic_preprocessor\sf_reputation.dll
dynamic_preprocessor C:\Snort\lib\dynamic_preprocessor\sf_sdf.dll
dynamic_preprocessor C:\Snort\lib\dynamic_preprocessor\sf_sip.dll
dynamic_preprocessor C:\Snort\lib\dynamic_preprocessor\sf_smtp.dll
dynamic_preprocessor C:\Snort\lib\dynamic_preprocessor\sf_ssh.dll
dynamic_preprocessor C:\Snort\lib\dynamic_preprocessor\sf_ssl.dll
  1. Save the changes and rerun the command.

Tip:
To quickly list all filenames, use the following in 

cmd
:

shell
dir /b

3. Third Error: 
snort_dynamicengine

Cause:
The 

snort_dynamicengine
path is incorrect.

Solution:

  1. Navigate to the folder 
    C:\Snort\lib\snort_dynamicengine
    .
  2. Update the 
    snort.conf
    file with the correct path (around line 265):
plaintext
dynamicengine C:\Snort\lib\snort_dynamicengine\sf_engine.dll
  1. Save the changes and rerun the command.

4. Fourth Error: 
snort_dynamicrules

Cause:
The folder for 

snort_dynamicrules
does not exist.

Solution:

  1. Create a folder named 
    snort_dynamicrules
    in 
    C:\Snort\lib
    .
  2. Update the 
    snort.conf
    file with the following (around line 268):
plaintext
dynamicdetection C:\Snort\lib\snort_dynamicrules
  1. Save the changes and rerun the command.

5. Fifth Error: 
normalize_ip4

Cause:
SNORT is set up for IDS mode by default, but the 

normalize_ip4
rules cause conflicts.

Solution:

  1. Open 
    snort.conf
    and search for 
    normalize_ip4
    .
  2. Comment out all lines containing 
    normalize
    (around line 280).
  3. Save the file and rerun the command.

6. Sixth Error: Missing 
white_list.rules

Cause:
The 

white_list.rules
file is missing.

Solution:

  1. Create an empty text file named 
    white_list.rules
    in the 
    C:\Snort\rules
    folder.
  2. Ensure file extensions are visible to confirm the 
    .rules
    extension.
  3. No changes are required in 
    snort.conf
    .
  4. Save and rerun the command.

7. Seventh Error: Missing 
black_list.rules

Cause:
The 

black_list.rules
file is missing.

Solution:

  1. Create an empty text file named 
    black_list.rules
    in the 
    C:\Snort\rules
    folder.
  2. Ensure file extensions are visible to confirm the 
    .rules
    extension.
  3. No changes are required in 
    snort.conf
    .
  4. Save and rerun the command.

After addressing all the errors, SNORT should work without issues.
To prevent future errors, we will be making some more changes in order to avoid further errors.

Change 1: Update Rule Paths

Update the rule paths in the configuration file from (around line 104):

plaintext
var RULE_PATH ../rules
var SO_RULE_PATH ../so_rules
var PREPROC_RULE_PATH ../preproc_rules

To:

plaintext
var RULE_PATH C:\Snort\rules
var SO_RULE_PATH C:\Snort\so_rules
var PREPROC_RULE_PATH C:\Snort\preproc_rules

Change 2: Update Whitelist and Blacklist Paths

Modify the paths for the whitelist and blacklist from (around line 113):

plaintext
var WHITE_LIST_PATH ../rules
var BLACK_LIST_PATH ../rules

To:

plaintext
var WHITE_LIST_PATH ..\rules
var BLACK_LIST_PATH ..\rules

Change 3: Update Whitelist and Blacklist File References

Update the references to whitelist and blacklist files from (around line 525):

plaintext
whitelist $WHITE_LIST_PATH/white_list.rules, \
blacklist $BLACK_LIST_PATH/black_list.rules

To:

plaintext
whitelist $WHITE_LIST_PATH\white_list.rules, \
blacklist $BLACK_LIST_PATH\black_list.rules

Change 4: Include Blacklist Rules

Correct the inclusion of the blacklist rules in the configuration file (around line 575):

plaintext
include $RULE_PATH/blacklist.rules

To:

plaintext
include $RULE_PATH/black_list.rules

Testing the Configuration File

Once all the changes are made, test the configuration file for errors using the following command:

shell
snort -i 4 -c c:\Snort\etc\snort.conf -l c:\Snort\log -T

Explanation of the Command:

  • -i 4
    : Specifies the interface to use (e.g., 
    4
    is the interface number).
  • -c c:\Snort\etc\snort.conf
    : Specifies the path to the configuration file.
  • -l c:\Snort\log
    : Specifies the path to the log folder.
  • -T
    : Enables testing mode to verify the configuration file.

Read Next

8/26/2026

[Day 2] 3. SNORT Rules

### **Writing a SNORT Rule** - To create a rule, start with an empty text file and write the rule in it. - Each rule is separated by a space. - T...

8/26/2026

[Day 2] 4. Network Adapters in VMWare

VMware provides several types of virtual network adapters, each with distinct behaviors for connecting virtual machines (VMs) to each other, the host...