Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

The Snort version available for Lucid is, for which snort rules are not available anymore. Is there a ppa for the updated version of snort or are there any good tutorials for installing snort from source.

share|improve this question
up vote 2 down vote accepted

Install via PPAs

The linked PPA has snort v2.9:

sudo add-apt-repository ppa:ebf0/gamelinux
sudo apt-get update

From my reading of the rules - any v2.9.x meets the rule standards - the .x are just stability updates.

Another PPA I've found is ppa:hurricanedefense/testing which contains v2.9.1 of snort.

As with all PPAs - these are for testing purposes and may make your system unstable. Have a full image backup available. You can also install ppa-purge to remove PPAs. N.B. enable the backports software source to install ppa-purge

Install via compilation

Data AcQuisition library

Download some prerequisites:

sudo apt-get install flex bison  build-essential checkinstall libpcap0.8-dev libnet1-dev

Now download and extract the latest daq source code from

cd daq-0.6.1/
sudo checkinstall
sudo dpkg -i daq_0.6.1-1_i386.deb


tar xvfz libdnet-1.12.tgz
cd libdnet-1.12/
sudo checkinstall
sudo dpkg -i libdnet_1.12-1_i386.deb
sudo ln -s /usr/local/lib/libdnet.1.0.1 /usr/lib/libdnet.1


sudo apt-get install libpcre3-dev libmysqlclient15-dev

Now download and extract the latest snort source code from

cd snort-2.9.1
./configure --with-mysql --enable-build-dynamic-examples  --enable-gre --enable-reload --enable-linux-smp-stats --enable-zlib
sudo checkinstall
sudo dpkg -i snort_2.9.1-1_i386.deb

sudo ldconfig

At this point you need to configure the snort.conf file according to your environment.


share|improve this answer
The snort available at ppa:ebf0/gamelinux doesn't have ncurses based configuration tool. And I couldn't get snort work with multiple interfaces. – nixnotwin Sep 18 '11 at 11:45
I added the second ppa with the commands you provided above. But it installs only the old snort from thr main repository. – nixnotwin Sep 18 '11 at 13:24
I got this error while startng snort: ERROR: parser.c(5260) Could not stat dynamic module path "/usr/lib/snort_dynamicpreprocessor/": No such file or directory. Fatal Error, Quitting.. – nixnotwin Sep 20 '11 at 8:50
make sure you remove the old snort package first before compiling and installing the new snort. – fossfreedom Sep 20 '11 at 8:55
I had purged the old one. But I solved this error by changing the path to: /usr/local/lib/snort_dynamicpreprocessor/. Antother error appeared now. It says there are some errors in the rules. So trying to get the new rules. – nixnotwin Sep 20 '11 at 10:06

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.