
How I deployed Snort 2.x on an Ubuntu VM to detect ICMP ping floods, Nmap SYN scans, and TCP port sweeps in a live lab network — with custom rules and real alert output.
RAMESH
0 followers

The lab runs on a private 192.168.111.0/24 network with three virtual machines, each playing a distinct role — attacker, victim, and the NIDS sensor.
Snort runs on the Ubuntu VM and listens passively on the ens33 interface, monitoring traffic flowing between the attacker and victim.
On the Ubuntu NIDS machine, I first updated the system, then enabled promiscuous mode on the network interface so Snort could capture all packets — not just those addressed to the VM itself.
$ sudo apt update -y && sudo apt upgrade -y
$ sudo apt install net-tools snort -y
$ sudo ip link set ens33 promisc onAfter installation, Snort 2.9.20 (Build 82) was confirmed running. I then edited /etc/snort/snort.conf to set the home network variable and include the custom rules file:
ipvar HOME_NET 192.168.111.0/24
ipvar EXTERNAL_NET any
# Inside the rules section:
include $RULE_PATH/local.rules
include $RULE_PATH/scan.rulesRather than relying on community rulesets alone, I wrote four targeted rules in /etc/snort/rules/local.rules to catch specific recon behaviors:
alert icmp any any -> $HOME_NET any (itype:8; detection_filter:track by_src, count 20, seconds 5; threshold:type limit, track by_src, count 1, seconds 5; msg:"[Lab] ICMP Ping Flood Detected"; sid:1000001; rev:1;)alert tcp any any -> $HOME_NET 22 (flags:S; msg:"[Lab] SSH Connection Attempt"; sid:1000002; rev:1;)alert tcp any any -> $HOME_NET any (flags:S; flow:stateless; detection_filter:track by_src, count 20, seconds 10; msg:"[Lab] Possible TCP SYN Scan"; sid:1000003; rev:1;)alert tcp any any -> $HOME_NET any (flags:S; flow:stateless; detection_filter:track by_src, count 50, seconds 5; msg:"[Lab] Possible Port Scan Activity"; sid:1000004; rev:1;)Before going live I ran Snort in test mode to catch any config errors:
$ sudo snort -T -c /etc/snort/snort.conf -i ens33Snort successfully validated the configuration! — confirmed, all 49,036 detection rules loaded cleanly.

With Snort running in console alert mode on the Ubuntu VM, I launched attacks from Kali:
# Nmap full TCP connect scan against Metasploitable-3
$ nmap -sS -F 192.168.111.135
# SSH-specific scan to port 22
$ nmap -sT -p 22 192.168.111.135
# ICMP ping flood with hping3
$ hping3 --icmp --flood 192.168.111.135