SNORT3 Installation Guide for RHEL9

Here's a comprehensive breakdown of the SNORT3 installation process on Red Hat Enterprise Linux 9, with explanations for each step:

1. System Update

dnf update

Purpose: Updates all installed packages to their latest versions, ensuring system security and compatibility before installing new software.

2. Install Development Tools

dnf group install "Development Tools"

Purpose: Installs essential compilation tools including GCC, make, and other utilities needed to build software from source code. Think of it as your digital toolbox for construction projects.

3. Install Core Dependencies

dnf install gcc gcc-c++ libnetfilter_queue-devel git flex bison zlib zlib-devel pcre pcre-devel libdnet tcpdump libnghttp2 wget xz-devel automake pkgconf-pkg-config

Purpose: Installs critical libraries and tools:

• gcc/gcc-c++: C/C++ compilers
• libnetfilter_queue-devel: Network packet filtering capabilities
• git: Version control (for downloading source code)
• flex/bison: Parser generators for processing configuration files
• zlib: Compression library
• pcre: Regular expression library (essential for pattern matching)
• libdnet: Low-level networking library
• tcpdump: Network packet analyzer

4. Install Additional Development Libraries

dnf install zlib-devel libpcap-devel pcre-devel libdnet-devel openssl-devel libnghttp2-devel luajit-devel

Purpose: Installs development headers for:

• libpcap: Packet capture functionality (the heart of network monitoring)
• openssl: Cryptographic functions
• luajit: Lua scripting engine for custom rules
• libnghttp2: HTTP/2 protocol support

5. Verify Additional Dependencies

*install hwloc cmake libtool and pkg-config if them have not installed.

Note: Check if these tools are installed. They're often included with Development Tools but may need manual installation.

6. Download LibDAQ (Data Acquisition Library)

wget https://api.github.com/repos/snort3/libdaq/tarball/v3.0.16

Purpose: Downloads the Data Acquisition library - SNORT's interface layer for capturing network packets from various sources.

7. Extract and Navigate

tar zxvf v3.0.16
cd v3.0.16

Purpose: Unpacks the downloaded archive and enters the source directory.

8. Build LibDAQ

./bootstrap
./configure --prefix=/usr/local/lib/daq_s3
make install

Purpose:

• bootstrap: Generates the configure script
• configure: Sets up build configuration with custom installation path
• make install: Compiles and installs LibDAQ to /usr/local/lib/daq_s3

9. Configure Dynamic Library Loading

touch /etc/ld.so.conf.d/snort.conf
echo "/usr/local/lib/daq_s3/lib/" > /etc/ld.so.conf.d/snort.conf
ldconfig

Purpose:

• Creates a configuration file telling the system where to find LibDAQ libraries
• ldconfig: Updates the dynamic linker cache so applications can locate the newly installed libraries

Pro Tip: This is like updating your GPS after building a new road - the system needs to know where to find your shiny new libraries!