NDC & PKI

[Day 9] 4. BARNYARD2 and SNORT

D
DITISS Admin
••15 min read

Objective: Snort generates binary (U2) output, which Barnyard2 processes and writes into an SQL database. Finally, Apache with PHP will display this data.

Setup Overview

  • Debian 12 (
    192.168.80.128
    ) – Main configuration machine.
  • Debian 8 – (
    192.168.80.132
    ).

Steps in Debian (Snort Configured Machine)

Prerequisite: You should have snort configured in your Linux Machine:

1. Install Required Packages

Run the following command to install all necessary dependencies:

bash
sudo apt-get install -y autoconf automake default-libmysqlclient-dev dos2unix libmariadb-dev-compat libmariadb-dev libmariadbd-dev libtool mariadb-client mariadb-server unzip

2. Install Compatible 
libpcap
for Barnyard2

  1. Check the current version of 

    libpcap
    installed on your system:

    bash
    dpkg -s libpcap0.8 | grep Version
dpkg -s libpcap0.8-dev | grep Version

  2. Purge the newer versions of 

    libpcap
    that are incompatible with Barnyard2:

    bash
    sudo apt-get purge libpcap0.8 libpcap0.8-dev

  3. Install the compatible version of 

    libpcap
    provided by sir:

    bash
    sudo dpkg -i libpcap0.8_1.8.1-6+deb10u1_amd64.deb libpcap0.8-dev_1.8.1-6+deb10u1_amd64.deb

    Note: This ensures compatibility for Barnyard2.

3. Configure Snort for Unified2 Output

  1. Open the Snort configuration file:

    bash
    sudo vim /etc/snort/snort.conf

  2. Locate Step 6 in the configuration file.

  3. Add the following line below the line starting with 

    output unified2:
    :

    plaintext
    output unified2: filename snort.u2, limit 128

    Explanation: This configures Snort to output its logs in Unified2 format, with files named 

    snort.u2
    and a size limit of 128MB.

4. Download and Prepare Barnyard2 Source Code

  1. Obtain the Barnyard2 source code (provided by sir.

  2. Unzip the downloaded file and navigate to the extracted folder:

    bash
    unzip <filename>
cd <foldername>

  3. Run the 

    autogen.sh
    script to generate the 
    configure
    file:

    bash
    sudo ./autogen.sh

5. Create Required Symbolic Link

Before proceeding with the 

configure
script, create a symbolic link for the 
dumbnet.h
header file:

bash
sudo ln -s /usr/include/dumbnet.h /usr/include/dnet.h
sudo ldconfig

6. Configure, Build, and Install Barnyard2

  1. Run the 

    configure
    script to specify that Barnyard2 will use MySQL:

    bash
    sudo ./configure --with-mysql --with-mysql-libraries=/usr/lib/x86_64-linux-gnu/

  2. Compile and install Barnyard2:

    bash
    sudo make
sudo make install

7. Verify Barnyard2 Installation

Check if Barnyard2 is installed and accessible:

bash
which barnyard2

If installed correctly, this will return the path to the 

barnyard2
binary.

8. Prepare Barnyard2 Configuration and Log Directory

  1. While still in the Barnyard2 source code directory, run the following commands:

    bash
    sudo cp etc/barnyard2.conf /etc/snort/  
sudo mkdir /var/log/barnyard2  
sudo chown snort:snort /var/log/barnyard2/  
sudo touch /var/log/snort/barnyard2.waldo  
sudo chown snort:snort /var/log/snort/barnyard2.waldo

    Explanation:

    • The 
      barnyard2.conf
      file is copied to Snort’s configuration directory.
    • The 
      barnyard2
      log directory is created, and permissions are set for the 
      snort
      user.
    • A 
      .waldo
      file is created for Barnyard2 to track processed log files.

9. Configure the MySQL Database

  1. Start the MySQL database:

    bash
    sudo mysql -u root -p

  2. In the MySQL prompt, execute the following commands:

    mysql
    CREATE DATABASE IF NOT EXISTS snort;  
USE snort;  
SOURCE /home/shuhari/barnyard2-master/schemas/create_mysql;  
SHOW TABLES;  
CREATE USER 'snort'@'localhost' IDENTIFIED BY 'toor';  
GRANT CREATE, INSERT, SELECT, DELETE, UPDATE ON snort.* TO 'snort'@'localhost';  
EXIT;

    Explanation:

    • A database named 
      snort
      is created, and the schema for Snort is loaded into it.
    • A user 
      snort
      with password 
      toor
      is created and granted permissions to manage the database.

10. Configure Barnyard2 for MySQL Integration

  1. Open the 

    barnyard2.conf
    file:

    bash
    sudo vim /etc/snort/barnyard2.conf

  2. Add the following line to the end of the file:

    plaintext
    output database: log, mysql, user=snort password=toor dbname=snort host=localhost

    Explanation: This tells Barnyard2 to log Snort’s data into the MySQL database using the configured credentials.

11. Restrict Permissions on the Barnyard2 Configuration File

  1. Run the following command to restrict access to the 

    barnyard2.conf
    file:

    bash
    sudo chmod o-r /etc/snort/barnyard2.conf

    Explanation: This ensures that unauthorized users cannot view the configuration file, enhancing security.

12. Configure Snort Rules with Revision Numbers

  1. Open the Snort local rules file:

    bash
    sudo vim /etc/snort/rules/local.rules

  2. Add the following rules with revision numbers:

    plaintext
    alert ip any any -> any any (msg: "Kuch Bhi"; sid:1000001; rev:1;)  
alert ip 192.168.0.10 any -> any any (msg: "From 10"; sid:1000002; rev:1;)  
alert ip 192.168.0.11 any -> any any (msg: "From 11"; sid:1000003; rev:1;)  
alert ip 192.168.0.12 any -> any any (msg: "From 12"; sid:1000004; rev:1;)  
alert ip 192.168.0.13 any -> any any (msg: "From 13"; sid:1000005; rev:1;)

    Explanation: Each rule includes a unique 

    sid
    (Signature ID) and 
    rev
    (revision number), which are critical for managing and identifying alerts.

13. Generate SID-to-Message Map

  1. Download the 

    create-sidmap.pl
    Perl script provided by sir.

  2. Set execution permissions and execute the script:

    bash
    chmod 755 create-sidmap.pl  
./create-sidmap.pl /etc/snort/rules

  3. Redirect the output of the script to generate the 

    sid-msg.map
    file:

    bash
    sudo sh -c "./create-sidmap.pl /etc/snort/rules > /etc/snort/sid-msg.map"

    Explanation:

    • The Perl script extracts 
      sid
      numbers and their corresponding messages from the 
      local.rules
      file.
    • The 
      sid-msg.map
      file is used by Snort and Barnyard2 for better management and logging of alerts.

Now, we will require 3 putty windows in order to monitor everything:

  • 1st Putty - Running Snort
  • 2nd Putty - Checking Logs
  • 3rd Putty - Running Barnyard2

14. Running Snort, Checking Logs, and Starting Barnyard2

Step 1: Running Snort (First Putty Window)

  1. List the contents of the Snort log directory: After execution of this command, you won't be able to see 

    snort.u2
    file:

    bash
    ls -l /var/log/snort

  2. Optionally, test the Snort configuration:

    bash
    sudo snort -T -c /etc/snort/snort.conf

    Explanation:

    • The 
      -T
      option tests the Snort configuration file for syntax errors.

  3. Run Snort to capture packets:

    bash
    sudo snort -q -i ens33 -u snort -g snort -c /etc/snort/snort.conf

    Explanation:

    • The 
      -q
      option runs Snort in quiet mode.
    • Packets are logged in the binary 
      snort.u2
      file under 
      /var/log/snort
      .

Step 2: Monitoring Logs (Second Putty Window)

  1. Check if the 

    snort.u2
    file is created:

    bash
    ls -l /var/log/snort

  2. Observe the file size grow as Snort captures more packets.

  3. Connect to the MySQL database and verify the 

    iphdr
    table:

    bash
    sudo mysql -u root -p

    mysql
    USE snort;
SHOW TABLES;
SELECT COUNT(*) FROM iphdr;

    Explanation:

    • Initially, the 
      iphdr
      table will not have any entries because Barnyard2 has not processed the 
      snort.u2
      file yet.

Step 3: Running Barnyard2 (Third Putty Window)

  1. Run Barnyard2 with the following command:

    bash
    sudo barnyard2 -c /etc/snort/barnyard2.conf -d /var/log/snort/ -f snort.u2 -w /var/log/snort/barnyard2.waldo -g snort -u snort

    Explanation:

    • -c
      : Specifies the configuration file.
    • -d
      : Sets the directory for Snort log files.
    • -f
      : Indicates the file to be processed (
      snort.u2
      ).
    • -w
      : Uses the 
      .waldo
      file to track progress.
    • -g
      and 
      -u
      : Define the group and user as 
      snort
      .

What is a 

.waldo
File?

  • A 
    .waldo
    file acts as a bookmark, recording the progress of Barnyard2.
  • When Barnyard2 runs again, it resumes from where it left off instead of reprocessing already-logged data.

15. Setting Up BASE (Basic Analysis and Security Engine)

We will be using BASE which is the Analysis Console for Intrusion Databases. This was developed in PHP and the last version was released in 2013. However, this is compatible with Debian 8. So, we will be running the image of Debian 8. The username is 

root
and password is 
toor
.

Step 1: Configure Debian 8 Sources List

  1. Open the 

    sources.list
    file:

    bash
    nano /etc/apt/sources.list

  2. Add the following repository:

    plaintext
    deb http://archive.debian.org/debian/ jessie main contrib non-free

  3. Save and exit the file.

16. Configuring MariaDB in Debian 12

Step 1: Allow External Connections to MariaDB

  1. Open the MariaDB configuration file:

    bash
    sudo vim /etc/mysql/mariadb.conf.d/50-server.cnf

  2. Add or update the following line:

    plaintext
    bind-address = 0.0.0.0

    Explanation:

    • This allows MariaDB to accept connections from all IP addresses.

Step 2: Restart MariaDB

  1. Restart and check the status of MariaDB:

    bash
    sudo systemctl restart mariadb
sudo systemctl status mariadb

17. Grant Permissions for Debian 8 Machine in MariaDB

  1. Log in to MariaDB on the Debian 12 machine:

    bash
    sudo mysql -u root -p

  2. Grant permissions to the Debian 8 machine:

    mysql
    GRANT CREATE, INSERT, SELECT, DELETE, UPDATE ON snort.* TO 'snort'@'<ip>' IDENTIFIED BY 'toor';
exit;

    Replace 

    <ip>
    with the IP address of the Debian 8 machine.
    Explanation:

    • This step allows the Debian 8 machine to access the Snort database on the Debian 12 machine.

18. Install MariaDB Client on Debian 8

  1. Update the package list:

    bash
    apt-get update

  2. Install the MariaDB client:

    bash
    apt-get install mariadb-client

19. Test Database Connectivity Between Debian 8 and Debian 12

Step 1: From Debian 8, connect to the Snort database on Debian 12

  1. Use the following command:

    bash
    mysql -u snort -p'toor' -h 192.168.80.128

    Replace 

    192.168.80.128
    with the actual IP of the Debian 12 machine.

  2. Once connected, verify the databases:

    mysql
    SHOW DATABASES;
exit;

Step 2: Install Required Packages on Debian 8 for BASE

  1. Install Apache, PHP, and additional dependencies:

    bash
    apt-get install apache2 php5 p7zip libapache2-mod-php5 php5-mcrypt php5-mysqlnd libphp-adodb unzip

    Note: During installation, a path will be shown. Note it down for later use.

  2. Verify the installation of BASE:

    bash
    ls -l | grep base

  3. Extract and move the BASE archive (provided by your instructor):

    bash
    tar -zxf base-1.4.5.tar.gz
mv base-1.4.5 /var/www/html/base
chown -R www-data:www-data /var/www/html/base

20. Configure PHP for BASE

  1. Open the PHP configuration file:

    bash
    nano /etc/php5/apache2/php.ini

  2. Search for the 

    error_reporting
    directive (on or near line 449):
    Replace the second occurrence with:

    plaintext
    E_ALL & ~E_NOTICE

  3. Restart the Apache service:

    bash
    sudo systemctl restart apache2
sudo systemctl status apache2

21. Access BASE via Browser

  1. Determine the IP address of the Debian 8 machine:

    bash
    ip addr

  2. On your browser, go to:

    http://<debian8_ip>/base

    Replace 

    <debian8_ip>
    with the actual IP address of the Debian 8 machine.

22. Configure BASE in the Browser

  1. Ensure all indicators on the screen are green.

  2. Replace the path displayed during the PHP package installation with the noted path.

  3. Provide the following database details:

    • Name: Snort
    • Hostname: IP of the Debian 12 machine
    • Database Name: snort
    • Password: toor

  4. Continue to the authentication setup:

    • Admin Username: snort
    • Password: toor
    • Full Name: Snort

23. Finalize BASE Setup

  1. Click on 

    CREATE BASE AG
    and proceed to Step 5.

  2. Start Barnyard2 from the third Putty window on Debian 12:

    bash
    sudo barnyard2 -c /etc/snort/barnyard2.conf -d /var/log/snort/ -f snort.u2 -w /var/log/snort/barnyard2.waldo -g snort -u snort

  3. Refresh the BASE web interface on Debian 8.
    Outcome: You should see changes and entries updated dynamically in the BASE web interface as Snort logs are processed by Barnyard2.

Read Next

8/26/2026

[Day 9] 5. Suricata

**Suricata** is an open-source, high-performance Intrusion Detection and Prevention System (IDS/IPS) that analyzes network traffic for malicious activ...

8/26/2026

[Day 9] 6. Blockchain

**Blockchain** is like a chain made of blocks. Each block holds some information, and the blocks are connected in a sequence. You can store anything i...