Building Snort 3

This page covers everything you need to build Snort 3 from source on Linux and macOS.

Dependencies

Required

Dependency	Source	Purpose
C++17 compiler (g++ >= 7)	System	Compilation
CMake	System	Build system
DAQ	GitHub	Packet I/O abstraction
dnet	GitHub	Network utility functions
hwloc	open-mpi.org	CPU affinity management
LuaJIT	luajit.org	Configuration and scripting
OpenSSL	openssl.org	SHA/MD5 signatures, protected_content rule option, SSL detection
pcap	tcpdump.org	Packet capture and tcpdump-style logging
PCRE2	pcre.org	Regular expression pattern matching
pkgconfig	freedesktop.org	Locates build dependencies
zlib >= 1.2.8	zlib.net	Decompression

Optional

Dependency	Source	Purpose
hyperscan >= 4.4.0	GitHub	High-performance regex via `regex` and `sd_pattern` rule options and Hyperscan search engine
cpputest	cpputest.github.io	Additional unit tests (`make check`)
libml	GitHub	Snort ML — neural network-based exploit detection
libunwind	nongnu.org	Readable backtraces on fatal signals
lzma >= 5.1.2	tukaani.org	Decompression of SWF and PDF files
safec >= 3.5	GitHub	Runtime bounds checks on legacy C-library calls
iconv	gnu.org	UTF16-LE to UTF8 filename conversion (usually in glibc)
uuid (uuid-dev)	System	Unique identifiers
asciidoc	asciidoc.org	Build the HTML manual
dblatex	sourceforge.net	Build the PDF manual (requires asciidoc)
w3m	sourceforge.net	Build the plain text manual
source-highlight	gnu.org	Generate the developer guide

Hyperscan is large. Follow the Hyperscan build instructions and build it as a shared library before enabling it in Snort.

Setting Up

Before building, set your install prefix and create the directory:

export my_path=/path/to/snorty
mkdir -p $my_path

If DAQ was installed to a custom (non-system) path, export PKG_CONFIG_PATH so cmake can find it:

export PKG_CONFIG_PATH=/libdaq/install/path/lib/pkgconfig:$PKG_CONFIG_PATH

Build Methods

configure_cmake.sh (Recommended)
ccmake (Interactive)
Xcode (macOS)

The configure_cmake.sh script is the simplest approach. It automatically creates and populates a build/ subdirectory.

./configure_cmake.sh --prefix=$my_path
cd build
make -j $(nproc)
make install
ln -s $my_path/conf $my_path/etc

Verify the build:

$my_path/bin/snort -V

If src/snort -V succeeds, the build is complete.Passing cmake options via configure_cmake.sh:You can pass cmake-style arguments directly:

./configure_cmake.sh --prefix=$my_path --enable-unit-tests

Use ccmake directly to configure from an arbitrary build directory. This is useful for fine-grained control over every cmake option through a terminal UI.

mkdir build && cd build
ccmake -G "Unix Makefiles" /path/to/snort3/tree
make -j $(nproc)
make install

You can also target Eclipse CDT:

ccmake -G "Eclipse CDT4 - Unix Makefiles" /path/to/snort3/tree
# Then in Eclipse: File > Import > Existing Eclipse Project

Snort 3 supports Xcode project generation on macOS via cmake generators.Option 1 — via configure_cmake.sh:

./configure_cmake.sh --generator=Xcode --prefix=$my_path

Option 2 — via ccmake:

ccmake -G Xcode /path/to/snort3/tree
open snort.xcodeproj

To build with g++ on macOS where clang is the default compiler, set the CXX environment variable before running cmake:

export CXX=g++
./configure_cmake.sh --prefix=$my_path

cmake Options

The following cmake options can be passed to configure_cmake.sh or directly to cmake/ccmake:

Option	Description
`--prefix=<path>`	Set the installation prefix
`--enable-shell`	Enable the local and remote command line shell
`--enable-unit-tests`	Configure unit tests; run with `snort --catch-test [tags]\|all`
`--enable-benchmark-tests`	Configure benchmark tests; run with `snort --catch-test [tags]\|all` or as a separate executable
`--generator=<gen>`	Specify a cmake project generator (e.g. `Xcode`, `Eclipse CDT4 - Unix Makefiles`)

Benchmark tests run best on a non-debug build with optimizations enabled. Avoid debug builds when measuring performance.

Example — build with unit tests enabled:

./configure_cmake.sh --prefix=$my_path --enable-unit-tests
cd build
make -j $(nproc) install

# Run all unit tests
$my_path/bin/snort --catch-test all

Adding plugins at runtime: Built-in and dynamic plugins are functionally equivalent. Load external plugin libraries at startup:

$my_path/bin/snort --plugin-path /path/to/install/lib -c snort.lua

Verifying the Build

After installation, confirm the binary works:

$my_path/bin/snort -V

Verify a configuration file loads without errors:

$my_path/bin/snort -c $my_path/etc/snort/snort.lua
$my_path/bin/snort -c $my_path/etc/snort/snort.lua -R $my_path/etc/snort/sample.rules

List available plugins to confirm modules compiled in:

$my_path/bin/snort --list-plugins

Common Build Issues

Hyperscan: dyld library not loaded on macOS

If you build with Hyperscan on macOS and see the following error when running src/snort:

dyld: Library not loaded: @rpath/libhs.4.0.dylib

Workaround 1 — export DYLD_LIBRARY_PATH with the path to libhs:

export DYLD_LIBRARY_PATH=/path/to/hyperscan/lib:$DYLD_LIBRARY_PATH

Workaround 2 — fix the rpath in the binary directly:

install_name_tool -change @rpath/libhs.4.0.dylib \
    /path-to/libhs.4.0.dylib src/snort

tcmalloc crash on Ubuntu 17.04 / 18.04

Snort built with tcmalloc support (--enable-tcmalloc) crashes immediately on Ubuntu 17.04 and 18.04 due to a bug in gperftools 2.5 provided by those distributions.Workaround — uninstall the distribution’s gperftools and install gperftools 2.7 before building Snort:

sudo apt-get remove google-perftools libgoogle-perftools-dev
# Download and build gperftools 2.7 from source
# https://github.com/gperftools/gperftools/releases

DAQ not found by cmake

If cmake cannot find LibDAQ, it means the library is not in a standard system path.Set PKG_CONFIG_PATH to point to the DAQ pkgconfig directory before running cmake:

export PKG_CONFIG_PATH=/libdaq/install/path/lib/pkgconfig:$PKG_CONFIG_PATH
./configure_cmake.sh --prefix=$my_path

dump DAQ fails with multiple threads

The dump DAQ does not work correctly with multiple packet threads.Workaround — disable dump output when using multiple threads:

snort -c snort.lua --daq dump --daq-var output=none --max-packet-threads 4 -r capture.pcap

Get Started

Configuration

Inspectors & Detection

Running Snort

Migration from Snort 2

Building Snort 3

Dependencies

Required

Optional

Setting Up

Build Methods

cmake Options

Verifying the Build

Common Build Issues

Build docs developers (and LLMs) love

Get Started

Configuration

Inspectors & Detection

Running Snort

Migration from Snort 2

​Dependencies

​Required

​Optional

​Setting Up

​Build Methods

​cmake Options

​Verifying the Build

​Common Build Issues

Build docs developers (and LLMs) love

Dependencies

Required

Optional

Setting Up

Build Methods

cmake Options

Verifying the Build

Common Build Issues