Snort (Intrusion Detection System)
Snort is a rule based IDS. Snort works in three different modes
which is as follows:
1) Sniffer Mode
2) Packet Logger Mode
3) Network Intrusion
Detection Mode
1)
Sniffer Mode :
Sniffer Mode allows you to dump data in the header and
body of each packet to the screen when you are running Snort. To start the
snort for displaying all application data, enter the command as follows:
./snort –d -> works in most of the version of
snort
./snort –dv -> for
getting an error message
2)
Packet Logger Mode :
Packet Logger Mode is different from Sniffer mode
because the packet data and headers are written to the hard drive of host on
which the snort is running. For writing to the directory named log write the
following command:
./snort –dev –l ./log
For capturing the logging data on the local network, it
is necessary to enter the ip address range of the network
./snort –dev –l ./log –h 192.168.1.0/24
For viewing only one type of data, you can use bpf to
filter out the unwanted traffic by entering the following command
./snort –dvr packet.log tcp
3)
Network Intrusion Detection
Mode :
Network Intrusion Detection Mode does not record the
packets but it allows rules that you have selected to apply. Snort.conf is
default file that contains all the rules. So Snort will inspect only the
traffic which is defined in snort.conf file. For starting the snort in
Intrusion Detection Mode enter the following command:
./snort –dev –l ./log –h 192.168.0/24 –c snort.conf
If you failed to enter the output directory will result
in the output being written in /var/log/snort
Rule in a custom manner.
Each rule consists of two parts: the rule header and the rule option. The rule
header contains the rule action (alert, log, pass, activate, or dynamic), type
of protocol, source and destination addresses, masks, source and destination
ports. The rule option has the content of the alert messages and information
concerning the portion of each packet.
Alert udp any any ->
192.168.1.0/24 135 (content: “| 06 4a 05 42|”; msg: ”Windows messenger service
message ”;)
Comments
Post a Comment