Compiling Snort_inline with NFQUEUE support on Ubuntu

Posted on by

I needed to setup the right libraries for Snort_inline development on my fresh Ubuntu Feisty installation, so I decided to write down the procedure for those who think compiling Snort_inline from source is hard. šŸ™‚

Make sure you have build-essential package installed. This makes sure you have a compiler and development packages for glibc and other important libraries. I’m installing the libraries from source to get the latest versions because the latest versions are more stable and perform better than the versions included in Feisty. I’m installing them into /usr because some programs like them there best.

Download the library libnfnetlink version 0.0.25 from http://ftp.netfilter.org/pub/libnfnetlink/

$ tar xvfj libnfnetlink-0.0.25.tar.bz2
$ cd libnfnetlink-0.0.25/
$ ./configure --prefix=/usr
$ make
$ sudo make install

Next download libnetfilter_queue version 0.0.13 from http://ftp.netfilter.org/pub/libnetfilter_queue/

$ tar xvfj libnetfilter_queue-0.0.13.tar.bz2
$ cd libnetfilter_queue-0.0.13
$ ./configure --prefix=/usr
$ make
$ sudo make install

Okay, that sets up the Netfilter libraries.

Next is the installation of libdnet. Do not use the dnet packages from Debian and Ubuntu because this is not the same library as we need for Snort_inline.

Download libdnet 1.11 from http://libdnet.sourceforge.net/

$ tar xzvf libdnet-1.11.tar.gz
$ cd libdnet-1.11
$ ./configure --prefix=/usr
$ make
$ sudo make install

Download snort_inline 2.6.1.5 from http://snort-inline.sourceforge.net/

$ tar xvzf snort_inline-2.6.1.5.tar.gz
$ cd snort_inline-2.6.1.5
$ ./configure --enable-nfnetlink
$ make
$ sudo make install

Test if it works (as root):

# iptables -A OUTPUT -p icmp -j NFQUEUE
# iptables -A INPUT -p icmp -j NFQUEUE
# /usr/local/bin/snort_inline -v -Q -H0

Then ping some host and you should see Snort_inline display the packets. If it doesn’t work, it might be that the kernel modules needed for nfqueue are not yet loaded. Using ‘lsmod’ check if ‘nfnetlink’ and ‘nfnetlink_queue’ are loaded. If not, load them manually.

After this, setup Snort_inline as normal.

7 thoughts on “Compiling Snort_inline with NFQUEUE support on Ubuntu”

  1. How about setting up nfqueue on centos? Is it pretty much the same? We are having pretty big latency issues with the regular QUEUE tag and our IPS for the whole network. Any chance you can recommend settings for 100Mbps of transfer and a lot of packets being processed?

  2. Pingback: Inliniac » Blog Archive » Multiple Snort_inline processes with Vuurmuur

  3. snort_inline: error while loading shared libraries: libdnet.1: cannot open shared object file: No such file or directory

  4. Not Using PCAP_FRAMES
    NFNETLINK answers: Invalid argument
    [19849] error during nfq_unbind_pf()

  5. ph4kx,

    just do it:

    ln -s /usr/local/lib/libdnet.1.0.1 /lib/libdnet.1

    regards.

  6. how can we load the libraries manually since I get an error while compiling nfqnl_test as “error during nfq_create_queue()”

  7. I solved the problem and it was so simple. I had to run it with as a root.
    sudo nfqnl_test

Comments are closed.