Configuring Snort 3 – what?

We saw the ways in which we configure Snort, namely, using command-line arguments and configuration files. In this section, we would like to understand the what side of Snort configuration.

Being a modular system was one of the design goals of the Snort 3 system. By this design, Snort is a heavily modularized system. Almost all the modules are plugins as well. The configuration is segregated by modules (or plugins) and thus well organized.

The snort.lua configuration file that ships with the Snort package gives a good guideline on how to do the Snort configuration. The steps are as follows:

1. Configure defaults.
2. Configure inspection.
3. Configure bindings.
4. Configure performance.
5. Configure detection.
6. Configure filters.
7. Configure outputs.

Let us walk through each of these sections starting with configuring defaults.

Configuring defaults

snort.lua references a file called snort_defaults.lua, as shown in the...