3

I am in the preliminary stages of designing a cybersecurity suite for my home network. I don't have any servers or anything, just the standard home setup (computers, tablets, game consoles). The bandwidth on my service plan is about 25-35Mbps and I really don't think I'm even using more than 50% of that at peak usage.

I want to setup Snort IDS on a small discrete device. I have a Raspberry Pi Zero W but that may be pushing it regarding system resources. Would a Pi 3 work? Does anyone have any experience with a similar setup?

I plan to use it in a network tap layout and I don't want to use a dedicated PC for just that one role. The usual setup for these is to have it as a VM but if I use a PC for multiple VMs, that leaves a single point of failure which I'd prefer to avoid, if I can.

So, can a Raspberry Pi (any version) run Snort without issue?

1

So, can a Raspberry Pi (any version) run Snort without issue?

No. Simply put the Pi (any of them) does not have enough RAM and CPU to make it work. It will simply not keep up.

And in case you ask. If you wanted to set it up to do the best it can and ignore any traffic it can't keep up with then don't do that. It's pointless monitoring some of your traffic and not all.

  • It seems from the response from Khurt Williams that it is possible and has been done before more than once? Have you tried this and it failed? If so, can you include more details so people know what to avoid (like using Kali instead of RaspbianLite? Thanks. – bashCypher Jan 15 at 0:04
5

Yes, you can. Here's how:

See section: "HOW TO INSTALL SNORT ON A RASPBERRY PI"

Follow some of the recommended best practices for expanding the memory space on your SD card once Raspbian is installed.

https://blog.holdenkilbride.com/index.php/2016/10/25/turn-your-raspberry-pi-into-a-snort-ids/

and another solution that uses Kali Linux as a starting point:

https://www.securityforrealpeople.com/2014/09/installing-kali-linux-and-snort-on.html

  • 1
    please do not just post links, include the relevant parts of the links in your answer – schroeder Sep 29 '17 at 15:11
  • These links still lack context. Your quote does not lead to anywhere in the referenced article. How do you expand the memory? That point is what will differentiate this answer from the others and provide a way forward. – schroeder Jan 14 at 21:36
4

Simple answer is no. Snort, at a min, requires 1-2GB of RAM and even then it can struggle. It would be difficult to get it to run efficiently on a Pi3 and very very difficult, if not impossible on a pi zero. I would not recommend using a Pi as an IDS/IPS system.

So what can you do? Well, if you have any older computers gathering dust, you can certainly configure one of those to run Snort or even look into Security Onion which is a Linux distribution with a suite of IDS tools including Bro which is very powerful. Also, look into PFsense which, can configure snort within it and act a network router, etc.etc. and so much more.

Don't have any computers gathering dust? You might be able to get by on an Intel Atom SBC. There are a ton of options but, the solution is more processing power and more RAM. Also a 1Gb NIC is preferable and the Pi 3 does not have that.

Okay, that's all fun but, what can you do with your pi? Well, I would honestly set-up Pi-hole if you haven't already.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.