# snort を Homebrew, apk, MacPorts, Nix, apt でインストール

snort のインストール経路、実行ファイル、メタデータ、AI エージェント向けセキュリティノートを確認します。

## インストール

```sh
sudo av install brew:snort
```

追加のインストールコマンド:

### macOS

- Homebrew (100%):

```sh
brew install snort
```

  証拠: local Homebrew formula metadata

- MacPorts (94%):

```sh
sudo port install snort
```

  証拠: MacPorts ports tree: net/snort/Portfile from https://api.github.com/repos/macports/macports-ports/git/trees/master?recursive=1

### Linux

- apk (92%):

```sh
sudo apk add snort
```

  証拠: Alpine Linux edge package indexes: snort from https://dl-cdn.alpinelinux.org/alpine/edge/main/x86_64/APKINDEX.tar.gz

- Nix (92%):

```sh
nix profile install nixpkgs#snort
```

  証拠: nixpkgs package indexes: pkgs/by-name/sn/snort/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1

- Ubuntu apt (92%):

```sh
sudo apt install snort
```

  証拠: Ubuntu 24.04 LTS package indexes: snort from https://archive.ubuntu.com/ubuntu/dists/noble/universe/binary-amd64/Packages.gz

## パッケージ情報

- **パッケージキー:** brew:snort
- **パッケージマネージャ:** Homebrew
- **パッケージマネージャページ:** <https://formulae.brew.sh/formula/snort>
- **バージョン:** 3.12.2.0
- **ソース概要:** Flexible Network Intrusion Detection System
- **ホームページ:** <https://www.snort.org>
- **リポジトリ:** <https://github.com/snort3/snort3>
- **上流ドキュメント:** <https://www.snort.org>
- **ライセンス:** GPL-2.0-only
- **ソースアーカイブ:** <https://github.com/snort3/snort3/archive/refs/tags/3.12.2.0.tar.gz>
- **最終更新:** 2026-06-27T17:38:03-04:00
- **生成日時:** 2026-08-04T22:13:35+00:00

## 実行可能ファイル

- appid_detector_builder.sh (cli)
- show_flows (cli)
- snort (cli)
- snort2lua (cli)
- u2boat (cli)
- u2spewfoo (cli)
- appid_detector_builder.sh (エイリアス)
- show_flows (エイリアス)
- snort (エイリアス)
- snort2lua (エイリアス)
- u2boat (エイリアス)
- u2spewfoo (エイリアス)

## 依存関係

- daq
- hwloc
- jemalloc
- libdnet
- libpcap
- luajit
- openssl@3
- pcre2
- vectorscan
- xz

## ビルド依存関係

- cmake
- flex
- pkgconf

## インストール挙動

- post-install フック: 未定義
- 注意点: For snort to be functional, you need to update the permissions for /dev/bpf* so that they can be read by non-root users. This can be done manually using: sudo chmod o+r /dev/bpf* or you could create a startup item to do this for you.
- Bottle: 利用可能 対象 arm64_linux, arm64_sequoia, arm64_sonoma, arm64_tahoe, sonoma, x86_64_linux

## バージョンと鮮度

- ページ生成日: 2026-08-04
- マネージャ版: 3.12.2.0
- マネージャ更新日: 2026-06-27
- ローカルデータ: OK
- 上流リポジトリ: https://github.com/snort3/snort3
- 情報: No cached GitHub release or tag data was available.
## プロジェクトの歴史と使われ方

Snort is a long-running open-source intrusion detection and prevention system whose command-line engine, rule language, and packaging history make it one of the canonical security tools in Unix and network-operations package collections.

### プロジェクトの歴史

Snort's official GPL page carries Martin Roesch copyrights beginning in 1998, and Snort's own site describes it as an open-source IPS capable of real-time traffic analysis and packet logging. The project evolved from a packet sniffer and logger into a rule-driven network IDS/IPS with community and subscriber rules.

Snort 3, also known in the repository README as Snort++, was officially released on January 19, 2021 as version 3.1.0.0 after more than seven years of development. The official announcement describes a ground-up rework with faster rules, more user control, multi-environment support, multi-threaded packet processing, Lua configuration, pluggable components, service autodetection, sticky buffers, and autogenerated reference documentation.

### 採用の歴史

Snort has a package-manager footprint because it is both a classic open-source security engine and an operational dependency for labs, appliances, training environments, and production sensors. The supplied package metadata lists Homebrew, Alpine, MacPorts, Nix, and Ubuntu packaging, while Snort.org points users to source releases, GitHub code, rule downloads, setup guides, and the Snort 3 manual.

### 使われ方

Snort is used as a packet sniffer, packet logger, network intrusion detection system, and inline prevention system. Snort 3 users typically build or install the engine, configure Lua files such as `snort.lua`, add rule sets, validate the configuration, then run against live interfaces or PCAP files with alert output suitable for analysts and automation.

### パッケージ好きにとっての重要性

Package nerds care about Snort because it exercises nearly every hard part of packaging security software: libpcap/DAQ integration, LuaJIT configuration, C++ build requirements, rule data that changes independently from the engine, optional acceleration libraries, service files, sample configs, and upgrades between major rule-engine generations.

### タイムライン

- 1998: Official GPL page lists Martin Roesch copyrights beginning with Snort's early releases.
- 2014: Snort 3-era copyright line begins under Cisco and affiliates in official version-output examples.
- 2021-01-19: Snort 3 version 3.1.0.0 officially released.
- 2026: Snort blog announces end-of-life for older Snort 2 and Snort 3 rule-support versions and encourages use of current Snort 3 packages.

### Related projects

- Snort is commonly discussed alongside tcpdump for packet sniffing, libpcap for capture, DAQ for packet I/O, Cisco Talos for rule development, and other IDS/IPS systems such as Suricata.

### ソース

- <https://blog.snort.org/2021/01/snort-3-officially-released.html>
- <https://blog.snort.org/2026/01/end-of-life-announcement-for-versions.html>
- <https://docs.snort.org/start/>
- <https://docs.snort.org/start/configuration>
- <https://github.com/snort3/snort3>
- <https://www.snort.org/>
- <https://www.snort.org/gpl>
- input.source_facts.package-manager


## セキュリティノート

broad file, network, media, or database tool signal.

- **Geiger リスク:** blue / 中
- broad file, network, media, or database tool signal


## Configuration and credential file locations

These source-backed paths show where this package keeps local settings or durable credentials. Automic Vault can use them as review targets for secret scanning, migration, and command approval.


## Configuration files

- Unix: snort.lua, snort_defaults.lua
## ソースデータベース詳細

- **Source Database:** Homebrew formula API
- **Tap:** homebrew/core
- **Full Name:** snort
- **Version Scheme:** 0
- **Revision:** 0
- **Head Version:** HEAD
- **Bottle Stable Root URL:** <https://ghcr.io/v2/homebrew/core>
- **Deprecated:** no
- **Disabled:** no
- **Keg Only:** no
- **URL Keys:** head, stable

## 他のパッケージマネージャ記録

- Nix - snort: normalized package name match | nixpkgs package indexes: pkgs/by-name/sn/snort/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1
- Ubuntu apt - snort - 2.9.20-0+deb11u1ubuntu1: normalized package name match | Ubuntu 24.04 LTS package indexes: snort from https://archive.ubuntu.com/ubuntu/dists/noble/universe/binary-amd64/Packages.gz | flexible Network Intrusion Detection System | https://www.snort.org/
- Ubuntu apt - snort-common - 2.9.20-0+deb11u1ubuntu1: normalized package name match | Ubuntu 24.04 LTS package indexes: snort-common from https://archive.ubuntu.com/ubuntu/dists/noble/universe/binary-amd64/Packages.gz | flexible Network Intrusion Detection System - common files | https://www.snort.org/
- Ubuntu apt - snort-common-libraries - 2.9.20-0+deb11u1ubuntu1: normalized package name match | Ubuntu 24.04 LTS package indexes: snort-common-libraries from https://archive.ubuntu.com/ubuntu/dists/noble/universe/binary-amd64/Packages.gz | flexible Network Intrusion Detection System - libraries | https://www.snort.org/
- Ubuntu apt - snort-doc - 2.9.20-0+deb11u1ubuntu1: normalized package name match | Ubuntu 24.04 LTS package indexes: snort-doc from https://archive.ubuntu.com/ubuntu/dists/noble/universe/binary-amd64/Packages.gz | flexible Network Intrusion Detection System - documentation | https://www.snort.org/
- Ubuntu apt - snort-rules-default - 2.9.20-0+deb11u1ubuntu1: normalized package name match | Ubuntu 24.04 LTS package indexes: snort-rules-default from https://archive.ubuntu.com/ubuntu/dists/noble/universe/binary-amd64/Packages.gz | flexible Network Intrusion Detection System - ruleset | http://www.snort.org/snort-rules/
- apk - snort - 3.9.2.0-r0: normalized package name match | Alpine Linux edge package indexes: snort from https://dl-cdn.alpinelinux.org/alpine/edge/main/x86_64/APKINDEX.tar.gz | Open source network intrusion prevention and detection system | https://www.snort.org/
- apk - snort-dev - 3.9.2.0-r0: normalized package name match | Alpine Linux edge package indexes: snort-dev from https://dl-cdn.alpinelinux.org/alpine/edge/main/x86_64/APKINDEX.tar.gz | Open source network intrusion prevention and detection system (development files) | https://www.snort.org/
- apk - snort-doc - 3.9.2.0-r0: normalized package name match | Alpine Linux edge package indexes: snort-doc from https://dl-cdn.alpinelinux.org/alpine/edge/main/x86_64/APKINDEX.tar.gz | Open source network intrusion prevention and detection system (documentation) | https://www.snort.org/
- apk - snort-openrc - 3.9.2.0-r0: normalized package name match | Alpine Linux edge package indexes: snort-openrc from https://dl-cdn.alpinelinux.org/alpine/edge/main/x86_64/APKINDEX.tar.gz | Open source network intrusion prevention and detection system (OpenRC init scripts) | https://www.snort.org/
- MacPorts - snort: normalized package name match | MacPorts ports tree: net/snort/Portfile from https://api.github.com/repos/macports/macports-ports/git/trees/master?recursive=1


## 関連リンク

- [Secret-risk packages](https://pkg.so/ja/secret-risk-packages/) - Has protected-tool coverage, approval-gate, or non-low Geiger security signals.
- [Terminal utility packages](https://pkg.so/ja/terminal-utilities/) - Matched terminal and command-line workflow metadata.
- [Networking and protocol packages](https://pkg.so/ja/networking-protocol-tools/) - Matched network, protocol, or remote-service metadata.
- [Security and crypto packages](https://pkg.so/ja/security-crypto-tools/) - Matched security, identity, cryptography, password, signing, or certificate metadata.
- [openssl@3](https://pkg.so/ja/brew/openssl-3/) - Runtime dependency declared by Homebrew.
- [xz](https://pkg.so/ja/brew/xz/) - Runtime dependency declared by Homebrew.
- [pcre2](https://pkg.so/ja/brew/pcre2/) - Runtime dependency declared by Homebrew.
- [luajit](https://pkg.so/ja/brew/luajit/) - Runtime dependency declared by Homebrew.
- [hwloc](https://pkg.so/ja/brew/hwloc/) - Runtime dependency declared by Homebrew.
- [libpcap](https://pkg.so/ja/brew/libpcap/) - Runtime dependency declared by Homebrew.
- [jemalloc](https://pkg.so/ja/brew/jemalloc/) - Runtime dependency declared by Homebrew.
- [libdnet](https://pkg.so/ja/brew/libdnet/) - Runtime dependency declared by Homebrew.
- [pkgconf](https://pkg.so/ja/brew/pkgconf/) - Build dependency declared by Homebrew.
- [cmake](https://pkg.so/ja/brew/cmake/) - Build dependency declared by Homebrew.
- [flex](https://pkg.so/ja/brew/flex/) - Build dependency declared by Homebrew.
- [suricata](https://pkg.so/ja/brew/suricata/) - Shares pkgdb curated category or tags: cli, ids, ips, network-security, security.
- [pulledpork](https://pkg.so/ja/brew/pulledpork/) - Shares pkgdb curated category or tags: cli, ids, intrusion-detection, rules, security.
- [openssh](https://pkg.so/ja/brew/openssh/) - Shares pkgdb curated category or tags: cli, network-security, security.
- [yara](https://pkg.so/ja/brew/yara/) - Shares pkgdb curated category or tags: cli, rules, security.
- [bettercap](https://pkg.so/ja/brew/bettercap/) - Shares pkgdb curated category or tags: cli, network-security, security.
- [strongswan](https://pkg.so/ja/brew/strongswan/) - Shares pkgdb curated category or tags: cli, network-security, security.
- [zeek](https://pkg.so/ja/brew/zeek/) - Shares pkgdb curated category or tags: cli, network-security, security.
- [ettercap](https://pkg.so/ja/brew/ettercap/) - Shares pkgdb curated category or tags: cli, network-security, security.
- [daq](https://pkg.so/ja/brew/daq/) - Security-sensitive metadata or terminology overlaps. Shared terms: cli, daq, detection, intrusion, intrusion-detection.

## Combined YAML source

View the package source record on GitHub. [combined/snort.yml](https://github.com/mxcl/pkgdb/blob/main/combined/snort.yml)


## ソース

- pkg.so package database
- Geiger risk classifier
- package-page enrichment
- curated configuration and credential file locations
- curated package history
- package version freshness
- pkgdb category and tag curation
- package relationship graph
- external package-manager database matches
- cross-ecosystem install command graph