Re: Ruleset advice for beginners
Michael Steele via Snort-users <[email protected]> Tue, 23 Jun 2026 19:25:04 +0000 (UTC)
| Newsgroups | gmane.comp.security.ids.snort.general |
|---|---|
| Message-ID | <[email protected]> |
This is a multipart message in MIME format. --===============8704304647244955086== Content-Type: multipart/alternative; boundary="----=_NextPart_000_0001_01DD0324.778B8080" Content-Language: en-us This is a multipart message in MIME format. ------=_NextPart_000_0001_01DD0324.778B8080 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Hi Jarlei, =20 Excellent write-up, and thank you for sharing this post-mortem! This is = exactly the kind of real-world feedback that saves the next person a = massive amount of work and headache. =20 You hit the nail on the head regarding the underlying mechanics. The re = driver for Realtek hardware and netmap have a notoriously rocky history = in the FreeBSD/pfSense ecosystem. When Snort hooks into Netmap for = inline IPS mode, it expects to see raw, untouched frames. If hardware = checksum offloading, LRO, or TSO are left enabled, the Realtek NIC tries = to front-load that processing. Netmap doesn't know what to do with those = modified mbufs, panics, and triggers the exact log loop and immediate = console lockup you experienced. =20 Your recovery steps were spot on, too. Dropping to the physical shell, = killing the process, and flushing the tables is often the only way back = into the house when the web GUI and management interface go completely = dark. =20 You are making the absolute right move by switching to the Intel = I350-T4. The igb driver for those Intel enterprise chips has native, = robust multi-queue support and handles Netmap effortlessly. Even with = the Intel card, it is still standard best practice in pfSense to = explicitly disable hardware checksums, TSO, and LRO under System > = Advanced > Networking when running Inline Mode to ensure packet = processing is handled cleanly by the OS and the DAQ engine. =20 Once you have that I350 dropped in and the offloads disabled, you'll = have a rock-solid hardware foundation. From there, you can safely circle = back to using PulledPork to gradually step up from passive alerts to = active drops without the hardware pulling the rug out from under you. =20 Keep us posted on how the deployment goes with the new Intel NIC! =20 Best regards, Michael =20 WINSNORT.com Management=E2=80=A6 -- ******************** Established ~ 2003 ********************** * FREE Windows Intrusion Detection System (WinIDS) Tutorials * * ~~ FREE Windows Support Forums ~~ * * Visit @ https://winsnort.com * * Snort: Open Source Network IDS - http://snort.org * ************************************************************** =20 From: Suporte Lapin T=C3=AAxtil <[email protected]>=20 Sent: Tuesday, June 23, 2026 1:18 PM To: Michael Steele <[email protected]>; [email protected]; = 'Jonathan Lee' <[email protected]> Subject: Re: [Snort-users] Ruleset advice for beginners =20 Hi everyone, I wanted to share a real-world "beginner scenario" post-mortem that = happened in my environment today, which perfectly aligns with Michael's = advice on testing and hardware dependencies. I recently tried to deploy pfSense-pkg-snort (Snort 2.9.x) on a pfSense = CE 2.8.1 box (FreeBSD 15-CURRENT base). Upon a clean installation with a = restored ruleset config, the entire network collapsed instantly, and the = local console became completely unresponsive, flooded with the following = loop: "netmap_transmit [xxxx] re1 drop mbuf that needs checksum offload" What I learned the hard way: 1. Hardware Matters: The firewall was running on Realtek PCIe GbE chips = (re driver). The combination of Snort trying to hook into Netmap while = Hardware Checksum Offloading, TSO, and LRO were still active globally = caused a fatal buffer conflict. 2. The Crash: Netmap dropped every single packet before it hit the OS = stack because the Realtek hardware was passing segmented/checksummed = packets that the DAQ engine couldn't parse. 3. The Fix: I had to drop to the physical shell, run 'killall -9 snort', = flush the 'snort2c' firewall table, and completely purge the package via = 'pkg delete'.=20 As Michael perfectly stated, you cannot just drop a premium ruleset = out-of-the-box and flip the block switch. In the pfSense/FreeBSD = ecosystem, running Snort/Suricata in Inline Mode (Netmap) on Realtek = hardware without strictly disabling all hardware offloading beforehand = is a recipe for a network-wide outage.=20 We are now migrating the box to a dedicated Intel I350-T4 quad-port NIC = to handle the multi-queue and Netmap requirements properly before = attempting IPS again. Hope this helps any other beginners troubleshooting console freezes with = Netmap and 're' drivers! Best regards, Jarlei Em 22/06/2026 13:35, Michael Steele via Snort-users escreveu: There is no way to download a pre-packaged, out-of-the-box ruleset = tailored perfectly to a specific environment right from the start. =20 While the Talos Subscriber ruleset gives you rapid, premium threat = updates, even those rules default primarily to alert actions. This is = intentional; if a ruleset dropped traffic by default, it would instantly = break legitimate services on a home network the moment a false positive = triggered. =20 PulledPork is exactly the tool you need to change this behavior, but its = base policies (Connectivity, Balanced, and Security) are only the = starting point. To move from passive alerts to active blocking (drop = actions), you need to configure PulledPork to rewrite the rule states = for you. =20 Building a custom ruleset that matches your specific network profile = will take a little work, but here is the general approach to get you = started: =20 1. Enable Inline Dropping in Snort First, make sure Snort is actually configured to drop traffic. If Snort = isn't running in inline mode (using DAQ modules like afpacket or nfq), = changing the rules to drop won't do anything=E2=80=94it will still only = log an alert. you need to ensure your execution mode supports blocking. =20 2. Leverage PulledPork's Modification Files Instead of editing the massive ruleset manually every day (which gets = overwritten on every update), you use PulledPork=E2=80=99s built-in = state modification files: dropsid.conf, enablesid.conf, and = disablesid.conf. 1. dropsid.conf: You can add specific Signature IDs (SIDs) or entire = rule categories here. PulledPork will automatically change the action = from alert to drop every time it downloads a new update. 2. disablesid.conf: Use this to turn off noisy or irrelevant rules (like = specific server vulnerabilities if you aren't running those servers at = home) to reduce overhead and false positives. =20 3. Start Small and Tune Start by using dropsid.conf on highly reliable, high-severity categories = (like known malware command-and-control communication or active = exploits). Watch your logs closely for a week to catch false positives = before expanding your drop list. =20 Tailoring a ruleset is an iterative process, but utilizing PulledPork to = manage the rule modifications is the standard, efficient way to handle = it. =20 WINSNORT.com Management=E2=80=A6 -- ******************** Established ~ 2003 ********************** * FREE Windows Intrusion Detection System (WinIDS) Tutorials * * ~~ FREE Windows Support Forums ~~ * * Visit @ http://winsnort.com * * Snort: Open Source Network IDS - http://snort.org * ************************************************************** =20 Best regards, Michael... =20 From: Snort-users <mailto:[email protected]> = <[email protected]> On Behalf Of Jonathan Lee via = Snort-users Sent: Thursday, June 18, 2026 12:07 PM To: Peter Lyons <mailto:[email protected]> <[email protected]> Cc: [email protected] <mailto:[email protected]>=20 Subject: Re: [Snort-users] Ruleset advice for beginners =20 You have to set block on alert and inline mode or legacy mode=20 Sent from my iPhone On Jun 18, 2026, at 08:50, Peter Lyons via Snort-users = <[email protected] <mailto:[email protected]> > = wrote: =EF=BB=BF=20 About a year ago I installed snort3 and pulledpork on ubuntu 24.04 to = provide better protection on my home network. =20 I registered and used the LightSPD_ruleset, rule_mode=3Dsimple, = ips_policy=3Dbalanced =20 Got it all working, and auto updating the LightSPD ruleset everyday. =20 At the start, I was checking the log $ tail -f /var/snort/alert_json.txt = to see if it was working. =20 So I felt very happy and secure. =20 Then the other day I checked the log file a bit more and noticed the log = file only had alert warnings and no rule actions like block or drop etc. =20 So then I checked the LightSPD_ruleset and noticed that by default the = rule actions are all set to alert warnings. =20 Which means I have to monitor the log file and customize the rules = myself. =20 While I=E2=80=99d call myself a linux enthusiast, I don=E2=80=99t have = the expertise to do that. =20 Is there a way to get a rule set suitable for a home network? =20 I=E2=80=99m thinking there might be a community rule set suitable or pay = for a subscribed Talos ruleset. =20 I=E2=80=99m assuming the subscribed ruleset comes with rule actions to = provide protection, and instant threat updates. Are my options correct?=20 =20 Advise please. PS: I am new to this mailing list. Peter Lyons =20 _______________________________________________ Snort-users mailing list [email protected] <mailto:[email protected]>=20 Go to this URL to change user options or unsubscribe: https://lists.snort.org/mailman/listinfo/snort-users To unsubscribe, send an email to: [email protected] = <mailto:[email protected]>=20 Please visit http://blog.snort.org to stay current on all the latest = Snort news! Please follow these rules: = https://snort.org/faq/what-is-the-mailing-list-etiquette _______________________________________________ Snort-users mailing list [email protected] <mailto:[email protected]>=20 Go to this URL to change user options or unsubscribe: https://lists.snort.org/mailman/listinfo/snort-users =20 To unsubscribe, send an email to: [email protected] = <mailto:[email protected]>=20 =20 Please visit http://blog.snort.org to stay current on all the latest = Snort news! =20 Please follow these rules: = https://snort.org/faq/what-is-the-mailing-list-etiquette ------=_NextPart_000_0001_01DD0324.778B8080 Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: quoted-printable <html xmlns:v=3D"urn:schemas-microsoft-com:vml" = xmlns:o=3D"urn:schemas-microsoft-com:office:office" = xmlns:w=3D"urn:schemas-microsoft-com:office:word" = xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" = xmlns=3D"http://www.w3.org/TR/REC-html40"><head><meta = http-equiv=3DContent-Type content=3D"text/html; charset=3Dutf-8"><meta = name=3DGenerator content=3D"Microsoft Word 15 (filtered = medium)"><style><!-- /* Font Definitions */ @font-face {font-family:"Cambria Math"; panose-1:2 4 5 3 5 4 6 3 2 4;} @font-face {font-family:Calibri; panose-1:2 15 5 2 2 2 4 3 2 4;} @font-face {font-family:Aptos;} @font-face {font-family:Tahoma; panose-1:2 11 6 4 3 5 4 4 2 4;} @font-face {font-family:Consolas; panose-1:2 11 6 9 2 2 4 3 2 4;} /* Style Definitions */ p.MsoNormal, li.MsoNormal, div.MsoNormal {margin:0in; font-size:12.0pt; font-family:"Aptos",sans-serif;} a:link, span.MsoHyperlink {mso-style-priority:99; color:blue; text-decoration:underline;} pre {mso-style-priority:99; mso-style-link:"HTML Preformatted Char"; margin:0in; font-size:10.0pt; font-family:"Courier New";} span.HTMLPreformattedChar {mso-style-name:"HTML Preformatted Char"; mso-style-priority:99; mso-style-link:"HTML Preformatted"; font-family:Consolas;} span.EmailStyle21 {mso-style-type:personal-reply; font-family:"Aptos",sans-serif; color:windowtext;} .MsoChpDefault {mso-style-type:export-only; font-size:10.0pt; mso-ligatures:none;} @page WordSection1 {size:8.5in 11.0in; margin:1.0in 1.0in 1.0in 1.0in;} div.WordSection1 {page:WordSection1;} /* List Definitions */ @list l0 {mso-list-id:379480347; mso-list-template-ids:49593788;} @list l0:level1 {mso-level-number-format:bullet; mso-level-text:=EF=82=B7; mso-level-tab-stop:.5in; mso-level-number-position:left; text-indent:-.25in; mso-ansi-font-size:10.0pt; font-family:Symbol;} @list l0:level2 {mso-level-number-format:bullet; mso-level-text:=EF=82=B7; mso-level-tab-stop:1.0in; mso-level-number-position:left; text-indent:-.25in; mso-ansi-font-size:10.0pt; font-family:Symbol;} @list l0:level3 {mso-level-number-format:bullet; mso-level-text:=EF=82=B7; mso-level-tab-stop:1.5in; mso-level-number-position:left; text-indent:-.25in; mso-ansi-font-size:10.0pt; font-family:Symbol;} @list l0:level4 {mso-level-number-format:bullet; mso-level-text:=EF=82=B7; mso-level-tab-stop:2.0in; mso-level-number-position:left; text-indent:-.25in; mso-ansi-font-size:10.0pt; font-family:Symbol;} @list l0:level5 {mso-level-number-format:bullet; mso-level-text:=EF=82=B7; mso-level-tab-stop:2.5in; mso-level-number-position:left; text-indent:-.25in; mso-ansi-font-size:10.0pt; font-family:Symbol;} @list l0:level6 {mso-level-number-format:bullet; mso-level-text:=EF=82=B7; mso-level-tab-stop:3.0in; mso-level-number-position:left; text-indent:-.25in; mso-ansi-font-size:10.0pt; font-family:Symbol;} @list l0:level7 {mso-level-number-format:bullet; mso-level-text:=EF=82=B7; mso-level-tab-stop:3.5in; mso-level-number-position:left; text-indent:-.25in; mso-ansi-font-size:10.0pt; font-family:Symbol;} @list l0:level8 {mso-level-number-format:bullet; mso-level-text:=EF=82=B7; mso-level-tab-stop:4.0in; mso-level-number-position:left; text-indent:-.25in; mso-ansi-font-size:10.0pt; font-family:Symbol;} @list l0:level9 {mso-level-number-format:bullet; mso-level-text:=EF=82=B7; mso-level-tab-stop:4.5in; mso-level-number-position:left; text-indent:-.25in; mso-ansi-font-size:10.0pt; font-family:Symbol;} @list l1 {mso-list-id:741024679; mso-list-template-ids:-738697634;} @list l1:level1 {mso-level-tab-stop:.5in; mso-level-number-position:left; text-indent:-.25in;} @list l1:level2 {mso-level-tab-stop:1.0in; mso-level-number-position:left; text-indent:-.25in;} @list l1:level3 {mso-level-tab-stop:1.5in; mso-level-number-position:left; text-indent:-.25in;} @list l1:level4 {mso-level-tab-stop:2.0in; mso-level-number-position:left; text-indent:-.25in;} @list l1:level5 {mso-level-tab-stop:2.5in; mso-level-number-position:left; text-indent:-.25in;} @list l1:level6 {mso-level-tab-stop:3.0in; mso-level-number-position:left; text-indent:-.25in;} @list l1:level7 {mso-level-tab-stop:3.5in; mso-level-number-position:left; text-indent:-.25in;} @list l1:level8 {mso-level-tab-stop:4.0in; mso-level-number-position:left; text-indent:-.25in;} @list l1:level9 {mso-level-tab-stop:4.5in; mso-level-number-position:left; text-indent:-.25in;} ol {margin-bottom:0in;} ul {margin-bottom:0in;} --></style><!--[if gte mso 9]><xml> <o:shapedefaults v:ext=3D"edit" spidmax=3D"1026" /> </xml><![endif]--><!--[if gte mso 9]><xml> <o:shapelayout v:ext=3D"edit"> <o:idmap v:ext=3D"edit" data=3D"1" /> </o:shapelayout></xml><![endif]--></head><body lang=3DEN-US link=3Dblue = vlink=3Dpurple style=3D'word-wrap:break-word'><div = class=3DWordSection1><p class=3DMsoNormal>Hi Jarlei,<o:p></o:p></p><p = class=3DMsoNormal><o:p> </o:p></p><p class=3DMsoNormal>Excellent = write-up, and thank you for sharing this post-mortem! This is exactly = the kind of real-world feedback that saves the next person a massive = amount of work and headache.<o:p></o:p></p><p = class=3DMsoNormal><o:p> </o:p></p><p class=3DMsoNormal>You hit the = nail on the head regarding the underlying mechanics. The re driver for = Realtek hardware and netmap have a notoriously rocky history in the = FreeBSD/pfSense ecosystem. When Snort hooks into Netmap for inline IPS = mode, it expects to see raw, untouched frames. If hardware checksum = offloading, LRO, or TSO are left enabled, the Realtek NIC tries to = front-load that processing. Netmap doesn't know what to do with those = modified mbufs, panics, and triggers the exact log loop and immediate = console lockup you experienced.<o:p></o:p></p><p = class=3DMsoNormal><o:p> </o:p></p><p class=3DMsoNormal>Your = recovery steps were spot on, too. Dropping to the physical shell, = killing the process, and flushing the tables is often the only way back = into the house when the web GUI and management interface go completely = dark.<o:p></o:p></p><p class=3DMsoNormal><o:p> </o:p></p><p = class=3DMsoNormal>You are making the absolute right move by switching to = the Intel I350-T4. The igb driver for those Intel enterprise chips has = native, robust multi-queue support and handles Netmap effortlessly. Even = with the Intel card, it is still standard best practice in pfSense to = explicitly disable hardware checksums, TSO, and LRO under <b>System > = Advanced > Networking</b> when running Inline Mode to ensure packet = processing is handled cleanly by the OS and the DAQ = engine.<o:p></o:p></p><p class=3DMsoNormal><o:p> </o:p></p><p = class=3DMsoNormal>Once you have that I350 dropped in and the offloads = disabled, you'll have a rock-solid hardware foundation. From there, you = can safely circle back to using PulledPork to gradually step up from = passive alerts to active drops without the hardware pulling the rug out = from under you.<o:p></o:p></p><p = class=3DMsoNormal><o:p> </o:p></p><p class=3DMsoNormal>Keep us = posted on how the deployment goes with the new Intel = NIC!<o:p></o:p></p><p class=3DMsoNormal><o:p> </o:p></p><p = class=3DMsoNormal>Best regards,<o:p></o:p></p><p = class=3DMsoNormal>Michael<o:p></o:p></p><p = class=3DMsoNormal><o:p> </o:p></p><div><p class=3DMsoNormal><span = style=3D'font-size:11.0pt;font-family:"Courier = New";mso-ligatures:standardcontextual'>WINSNORT.com = Management=E2=80=A6<o:p></o:p></span></p><p class=3DMsoNormal><span = style=3D'font-size:11.0pt;font-family:"Courier = New";mso-ligatures:standardcontextual'>--<o:p></o:p></span></p><p = class=3DMsoNormal><span style=3D'font-size:11.0pt;font-family:"Courier = New";mso-ligatures:standardcontextual'>******************** Established = ~ 2003 **********************<o:p></o:p></span></p><p = class=3DMsoNormal><span style=3D'font-size:11.0pt;font-family:"Courier = New";mso-ligatures:standardcontextual'>* FREE Windows Intrusion = Detection System (WinIDS) Tutorials *<o:p></o:p></span></p><p = class=3DMsoNormal><span style=3D'font-size:11.0pt;font-family:"Courier = New";mso-ligatures:standardcontextual'>*=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 ~~ FREE Windows Support Forums = ~~=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0 *<o:p></o:p></span></p><p class=3DMsoNormal><span = style=3D'font-size:11.0pt;font-family:"Courier = New";mso-ligatures:standardcontextual'>*=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 Visit @ = https://winsnort.com=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 = *<o:p></o:p></span></p><p class=3DMsoNormal><span = style=3D'font-size:11.0pt;font-family:"Courier = New";mso-ligatures:standardcontextual'>*=C2=A0=C2=A0=C2=A0=C2=A0 Snort: = Open Source Network IDS - http://snort.org=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 = *<o:p></o:p></span></p><p class=3DMsoNormal><span = style=3D'font-size:11.0pt;font-family:"Courier = New";mso-ligatures:standardcontextual'>**********************************= ****************************<o:p></o:p></span></p></div><p = class=3DMsoNormal><o:p> </o:p></p><div><div = style=3D'border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in = 0in 0in'><p class=3DMsoNormal><b><span = style=3D'font-size:11.0pt;font-family:"Calibri",sans-serif'>From:</span><= /b><span style=3D'font-size:11.0pt;font-family:"Calibri",sans-serif'> = Suporte Lapin T=C3=AAxtil <[email protected]> = <br><b>Sent:</b> Tuesday, June 23, 2026 1:18 PM<br><b>To:</b> Michael = Steele <[email protected]>; [email protected]; = 'Jonathan Lee' <[email protected]><br><b>Subject:</b> Re: = [Snort-users] Ruleset advice for = beginners<o:p></o:p></span></p></div></div><p = class=3DMsoNormal><o:p> </o:p></p><p>Hi everyone,<br><br>I wanted = to share a real-world "beginner scenario" post-mortem that = happened in my environment today, which perfectly aligns with Michael's = advice on testing and hardware dependencies.<br><br>I recently tried to = deploy pfSense-pkg-snort (Snort 2.9.x) on a pfSense CE 2.8.1 box = (FreeBSD 15-CURRENT base). Upon a clean installation with a restored = ruleset config, the entire network collapsed instantly, and the local = console became completely unresponsive, flooded with the following = loop:<br><br>"netmap_transmit [xxxx] re1 drop mbuf that needs = checksum offload"<br><br>What I learned the hard way:<br>1. = Hardware Matters: The firewall was running on Realtek PCIe GbE chips (re = driver). The combination of Snort trying to hook into Netmap while = Hardware Checksum Offloading, TSO, and LRO were still active globally = caused a fatal buffer conflict.<br>2. The Crash: Netmap dropped every = single packet before it hit the OS stack because the Realtek hardware = was passing segmented/checksummed packets that the DAQ engine couldn't = parse.<br>3. The Fix: I had to drop to the physical shell, run 'killall = -9 snort', flush the 'snort2c' firewall table, and completely purge the = package via 'pkg delete'. <br><br>As Michael perfectly stated, you = cannot just drop a premium ruleset out-of-the-box and flip the block = switch. In the pfSense/FreeBSD ecosystem, running Snort/Suricata in = Inline Mode (Netmap) on Realtek hardware without strictly disabling all = hardware offloading beforehand is a recipe for a network-wide = outage. <br><br>We are now migrating the box to a dedicated Intel = I350-T4 quad-port NIC to handle the multi-queue and Netmap requirements = properly before attempting IPS again.<br><br>Hope this helps any other = beginners troubleshooting console freezes with Netmap and 're' = drivers!<br><br>Best regards,<br>Jarlei<o:p></o:p></p><div><p = class=3DMsoNormal>Em 22/06/2026 13:35, Michael Steele via Snort-users = escreveu:<o:p></o:p></p></div><blockquote = style=3D'margin-top:5.0pt;margin-bottom:5.0pt'><div><p class=3DMsoNormal = style=3D'mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>There is no = way to download a pre-packaged, out-of-the-box ruleset tailored = perfectly to a specific environment right from the = start.<o:p></o:p></p><p class=3DMsoNormal = style=3D'mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> <o:p><= /o:p></p><p class=3DMsoNormal = style=3D'mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>While the = Talos Subscriber ruleset gives you rapid, premium threat updates, even = those rules default primarily to alert actions. This is intentional; if = a ruleset dropped traffic by default, it would instantly break = legitimate services on a home network the moment a false positive = triggered.<o:p></o:p></p><p class=3DMsoNormal = style=3D'mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> <o:p><= /o:p></p><p class=3DMsoNormal = style=3D'mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>PulledPork = is exactly the tool you need to change this behavior, but its base = policies (Connectivity, Balanced, and Security) are only the starting = point. To move from passive alerts to active blocking (drop actions), = you need to configure PulledPork to rewrite the rule states for = you.<o:p></o:p></p><p class=3DMsoNormal = style=3D'mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> <o:p><= /o:p></p><p class=3DMsoNormal = style=3D'mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>Building a = custom ruleset that matches your specific network profile will take a = little work, but here is the general approach to get you = started:<o:p></o:p></p><p class=3DMsoNormal = style=3D'mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><b> </b= ><o:p></o:p></p><p class=3DMsoNormal = style=3D'mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><b>1. = Enable Inline Dropping in Snort</b><o:p></o:p></p><p class=3DMsoNormal = style=3D'mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>First, make = sure Snort is actually configured to drop traffic. If Snort isn't = running in inline mode (using DAQ modules like afpacket or nfq), = changing the rules to drop won't do anything=E2=80=94it will still only = log an alert. you need to ensure your execution mode supports = blocking.<o:p></o:p></p><p class=3DMsoNormal = style=3D'mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><b> </b= ><o:p></o:p></p><p class=3DMsoNormal = style=3D'mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><b>2. = Leverage PulledPork's Modification Files</b><o:p></o:p></p><p = class=3DMsoNormal = style=3D'mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>Instead of = editing the massive ruleset manually every day (which gets overwritten = on every update), you use PulledPork=E2=80=99s built-in state = modification files: dropsid.conf, enablesid.conf, and = disablesid.conf.<o:p></o:p></p><ol start=3D1 type=3D1><li = class=3DMsoNormal = style=3D'mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l1 = level1 lfo3'><b>dropsid.conf</b>: You can add specific Signature IDs = (SIDs) or entire rule categories here. PulledPork will automatically = change the action from alert to drop every time it downloads a new = update.<o:p></o:p></li><li class=3DMsoNormal = style=3D'mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l1 = level1 lfo3'><b>disablesid.conf</b>: Use this to turn off noisy or = irrelevant rules (like specific server vulnerabilities if you aren't = running those servers at home) to reduce overhead and false = positives.<o:p></o:p></li></ol><p class=3DMsoNormal = style=3D'mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><b> </b= ><o:p></o:p></p><p class=3DMsoNormal = style=3D'mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><b>3. Start = Small and Tune</b><o:p></o:p></p><p class=3DMsoNormal = style=3D'mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>Start by = using dropsid.conf on highly reliable, high-severity categories (like = known malware command-and-control communication or active exploits). = Watch your logs closely for a week to catch false positives before = expanding your drop list.<o:p></o:p></p><p class=3DMsoNormal = style=3D'mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> <o:p><= /o:p></p><p class=3DMsoNormal = style=3D'mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>Tailoring a = ruleset is an iterative process, but utilizing PulledPork to manage the = rule modifications is the standard, efficient way to handle = it.<o:p></o:p></p><p class=3DMsoNormal = style=3D'mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> <o:p><= /o:p></p><div><p class=3DMsoNormal = style=3D'mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span = style=3D'font-size:11.0pt;font-family:"Courier = New";mso-ligatures:standardcontextual'>WINSNORT.com = Management=E2=80=A6</span><o:p></o:p></p><p class=3DMsoNormal = style=3D'mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span = style=3D'font-size:11.0pt;font-family:"Courier = New";mso-ligatures:standardcontextual'>--</span><o:p></o:p></p><p = class=3DMsoNormal = style=3D'mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span = style=3D'font-size:11.0pt;font-family:"Courier = New";mso-ligatures:standardcontextual'>******************** Established = ~ 2003 **********************</span><o:p></o:p></p><p class=3DMsoNormal = style=3D'mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span = style=3D'font-size:11.0pt;font-family:"Courier = New";mso-ligatures:standardcontextual'>* FREE Windows Intrusion = Detection System (WinIDS) Tutorials *</span><o:p></o:p></p><p = class=3DMsoNormal = style=3D'mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span = style=3D'font-size:11.0pt;font-family:"Courier = New";mso-ligatures:standardcontextual'>* &nb= sp; ~~ FREE Windows Support Forums = ~~  = ; *</span><o:p></o:p></p><p class=3DMsoNormal = style=3D'mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span = style=3D'font-size:11.0pt;font-family:"Courier = New";mso-ligatures:standardcontextual'>* &nb= sp; Visit @ <a = href=3D"http://winsnort.com">http://winsnort.com</a> &nb= sp; &nbs= p; *</span><o:p></o:p></p><p class=3DMsoNormal = style=3D'mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span = style=3D'font-size:11.0pt;font-family:"Courier = New";mso-ligatures:standardcontextual'>* Snort: = Open Source Network IDS - <a = href=3D"http://snort.org">http://snort.org</a> &nb= sp; *</span><o:p></o:p></p><p class=3DMsoNormal = style=3D'mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span = style=3D'font-size:11.0pt;font-family:"Courier = New";mso-ligatures:standardcontextual'>**********************************= ****************************</span><o:p></o:p></p><p class=3DMsoNormal = style=3D'mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span = style=3D'font-size:11.0pt;font-family:"Courier = New";mso-ligatures:standardcontextual'> </span><o:p></o:p></p><p = class=3DMsoNormal = style=3D'mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span = style=3D'font-size:11.0pt;font-family:"Courier = New";mso-ligatures:standardcontextual'>Best = regards,</span><o:p></o:p></p><p class=3DMsoNormal = style=3D'mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span = style=3D'font-size:11.0pt;font-family:"Courier = New";mso-ligatures:standardcontextual'>Michael...</span><o:p></o:p></p></= div><p class=3DMsoNormal = style=3D'mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> <o:p><= /o:p></p><div><div style=3D'border:none;border-top:solid #E1E1E1 = 1.0pt;padding:3.0pt 0in 0in 0in'><p class=3DMsoNormal = style=3D'mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><b><span = style=3D'font-size:11.0pt;font-family:"Calibri",sans-serif'>From:</span><= /b><span style=3D'font-size:11.0pt;font-family:"Calibri",sans-serif'> = Snort-users <a = href=3D"mailto:[email protected]"><snort-users-bounc= [email protected]></a> <b>On Behalf Of </b>Jonathan Lee via = Snort-users<br><b>Sent:</b> Thursday, June 18, 2026 12:07 = PM<br><b>To:</b> Peter Lyons <a = href=3D"mailto:[email protected]"><[email protected]></a><br><b>Cc:= </b> <a = href=3D"mailto:[email protected]">[email protected]</= a><br><b>Subject:</b> Re: [Snort-users] Ruleset advice for = beginners</span><o:p></o:p></p></div></div><p class=3DMsoNormal = style=3D'mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> <o:p><= /o:p></p><p class=3DMsoNormal = style=3D'mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>You have to = set block on alert and inline mode or legacy = mode <o:p></o:p></p><div><p class=3DMsoNormal = style=3D'mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>Sent from = my iPhone<o:p></o:p></p></div><div><p class=3DMsoNormal = style=3D'mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><br><br><br>= <o:p></o:p></p><blockquote = style=3D'margin-top:5.0pt;margin-bottom:5.0pt'><p class=3DMsoNormal = style=3D'mso-margin-top-alt:auto;margin-bottom:12.0pt'>On Jun 18, 2026, = at 08:50, Peter Lyons via Snort-users <<a = href=3D"mailto:[email protected]">[email protected]</= a>> wrote:<o:p></o:p></p></blockquote></div><blockquote = style=3D'margin-top:5.0pt;margin-bottom:5.0pt'><div><p class=3DMsoNormal = style=3D'mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span = style=3D'font-family:"Tahoma",sans-serif'>=EF=BB=BF</span> = <o:p></o:p></p><p style=3D'margin-bottom:0in'>About a year ago I = installed snort3 and pulledpork on ubuntu 24.04 to provide better = protection on my home network.<o:p></o:p></p><p = style=3D'margin-bottom:0in'> <o:p></o:p></p><p = style=3D'margin-bottom:0in'>I registered and used the LightSPD_ruleset, = rule_mode=3Dsimple, ips_policy=3Dbalanced<o:p></o:p></p><p = style=3D'margin-bottom:0in'> <o:p></o:p></p><p = style=3D'margin-bottom:0in'>Got it all working, and auto updating the = LightSPD ruleset everyday.<o:p></o:p></p><p = style=3D'margin-bottom:0in'> <o:p></o:p></p><p = style=3D'margin-bottom:0in'>At the start, I was checking the log $ tail = -f /var/snort/alert_json.txt to see if it was working.<o:p></o:p></p><p = style=3D'margin-bottom:0in'> <o:p></o:p></p><p = style=3D'margin-bottom:0in'>So I felt very happy and = secure.<o:p></o:p></p><p = style=3D'margin-bottom:0in'> <o:p></o:p></p><p = style=3D'margin-bottom:0in'>Then the other day I checked the log file a = bit more and noticed the log file only had <b>alert warnings</b> and no = rule actions like block or drop etc.<o:p></o:p></p><p = style=3D'margin-bottom:0in'> <o:p></o:p></p><p = style=3D'margin-bottom:0in'>So then I checked the LightSPD_ruleset and = noticed that by default the rule actions are all set to <b>alert = warnings.</b><o:p></o:p></p><p = style=3D'margin-bottom:0in'> <o:p></o:p></p><p = style=3D'margin-bottom:0in'>Which means I have to monitor the log file = and customize the rules myself.<o:p></o:p></p><p = style=3D'margin-bottom:0in'> <o:p></o:p></p><p = style=3D'margin-bottom:0in'>While I=E2=80=99d call myself a linux = enthusiast, I don=E2=80=99t have the expertise to do = that.<o:p></o:p></p><p = style=3D'margin-bottom:0in'> <o:p></o:p></p><p = style=3D'margin-bottom:0in'><b>Is there a way to get a rule set suitable = for a home network?</b><o:p></o:p></p><p = style=3D'margin-bottom:0in'> <o:p></o:p></p><p = style=3D'margin-bottom:0in'>I=E2=80=99m thinking there might be a = community rule set suitable or pay for a subscribed Talos = ruleset.<o:p></o:p></p><p = style=3D'margin-bottom:0in'> <o:p></o:p></p><p = style=3D'margin-bottom:0in'>I=E2=80=99m assuming the subscribed ruleset = comes with rule actions to provide protection, and instant threat = updates.<o:p></o:p></p><p style=3D'margin-bottom:0in'>Are my options = correct? <o:p></o:p></p><p = style=3D'margin-bottom:0in'> <o:p></o:p></p><p = style=3D'margin-bottom:0in'>Advise please.<o:p></o:p></p><p>PS: I am new = to this mailing list.<o:p></o:p></p><p>Peter = Lyons<o:p></o:p></p><p> <o:p></o:p></p><p class=3DMsoNormal = style=3D'mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>____________= ___________________________________<br>Snort-users mailing list<br><a = href=3D"mailto:[email protected]">[email protected]</= a><br>Go to this URL to change user options or unsubscribe:<br><a = href=3D"https://lists.snort.org/mailman/listinfo/snort-users">https://lis= ts.snort.org/mailman/listinfo/snort-users</a><br><br> To = unsubscribe, send an email to:<br> <a = href=3D"mailto:[email protected]">snort-users-leave@lists= .snort.org</a><br><br>Please visit <a = href=3D"http://blog.snort.org">http://blog.snort.org</a> to stay current = on all the latest Snort news!<br><br>Please follow these rules: <a = href=3D"https://snort.org/faq/what-is-the-mailing-list-etiquette">https:/= /snort.org/faq/what-is-the-mailing-list-etiquette</a><o:p></o:p></p></div= ></blockquote></div><p = class=3DMsoNormal><br><br><o:p></o:p></p><pre>___________________________= ____________________<o:p></o:p></pre><pre>Snort-users mailing = list<o:p></o:p></pre><pre><a = href=3D"mailto:[email protected]">[email protected]</= a><o:p></o:p></pre><pre>Go to this URL to change user options or = unsubscribe:<o:p></o:p></pre><pre><a = href=3D"https://lists.snort.org/mailman/listinfo/snort-users">https://lis= ts.snort.org/mailman/listinfo/snort-users</a><o:p></o:p></pre><pre><o:p>&= nbsp;</o:p></pre><pre>=C2=A0 To unsubscribe, send an email = to:<o:p></o:p></pre><pre>=C2=A0 <a = href=3D"mailto:[email protected]">snort-users-leave@lists= .snort.org</a><o:p></o:p></pre><pre><o:p> </o:p></pre><pre>Please = visit <a href=3D"http://blog.snort.org">http://blog.snort.org</a> to = stay current on all the latest Snort = news!<o:p></o:p></pre><pre><o:p> </o:p></pre><pre>Please follow = these rules: <a = href=3D"https://snort.org/faq/what-is-the-mailing-list-etiquette">https:/= /snort.org/faq/what-is-the-mailing-list-etiquette</a><o:p></o:p></pre></b= lockquote></div></body></html> ------=_NextPart_000_0001_01DD0324.778B8080-- --===============8704304647244955086== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Snort-users mailing list [email protected] Go to this URL to change user options or unsubscribe: https://lists.snort.org/mailman/listinfo/snort-users To unsubscribe, send an email to: [email protected] Please visit http://blog.snort.org to stay current on all the latest Snort news! Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette --===============8704304647244955086==--