|
|
| (9 intermediate revisions by 2 users not shown) |
| Line 3: |
Line 3: |
| | NIDS are an [[IDS]] that monitor all traffic to and from all network devices. It will read incoming [[Packet|packets]] looking for suspicious patterns. Popular NIDs such as [[snort]] and [[Cisco IDS]] are used often-times in conjunction with a [[firewall]] to form an [[IPS]]. Also commonly used to send information to a [[SIM]] or [[SIM|SIMS]] | | NIDS are an [[IDS]] that monitor all traffic to and from all network devices. It will read incoming [[Packet|packets]] looking for suspicious patterns. Popular NIDs such as [[snort]] and [[Cisco IDS]] are used often-times in conjunction with a [[firewall]] to form an [[IPS]]. Also commonly used to send information to a [[SIM]] or [[SIM|SIMS]] |
| | | | |
| − | ==Snort==
| + | {{countermeasures}} |
| − | | + | |
| − | Snort is a packet sniffer and intrusion detection system that can be used to add a layer of surveillance to your system. In this way, it is similar to tcpdump, but with some more advanced rule-setting capabilities for detecting certain forms of packets. Snort is one of the most widely used IDSes under Linux, and a port exists for the Windows [[Operating System]].
| + | |
| − | | + | |
| − | ===Basic Packet Sniffing Utilities===
| + | |
| − | | + | |
| − | Once installed, snort can be set up with basic packet sniffing functionality simply by typing "snort" into a terminal or command prompt. It will run in the default mode using the default interface - for me, this is eth0, the wired connection. A new interface can be specified with the -i option. For example, to run snort on the wireless interace:
| + | |
| − | | + | |
| − | {{code|text= | + | |
| − | snort -i wlan0
| + | |
| − | }} | + | |
| − | | + | |
| − | By default, the packets will be displayed to STDOUT as packets are capture, which isn't particularly useful. In order to log to a tcpdump-syntax file, you can use the -l option, for example:
| + | |
| − | | + | |
| − | {{code|text=
| + | |
| − | snort -l /var/log/sniff/
| + | |
| − | }}
| + | |
| − | | + | |
| − | In order to read the logs, use a program capable of reading tcpdump-style logs - with tcpdump, use the -r option to read - you may wish to pipe it through less for readability:
| + | |
| − | | + | |
| − | {{code|text=
| + | |
| − | tcpdump -r /var/log/sniff/snort.log.03229112 | less
| + | |
| − | }}
| + | |
| − | | + | |
| − | | + | |
| − | Some other useful options:
| + | |
| − | | + | |
| − | * -v: show only packet headers
| + | |
| − | * -vd: show bothc packet headers and data
| + | |
| − | | + | |
| − | ===Rules===
| + | |
| − | | + | |
| − | Under its default configuration, Snort really isn't much more useful than a packet sniffer - its power as an intrusion detection system comes from its power to process received packets and raise a flag based on a file containing directives on how to treat malformed & potentially malicious packets, which is known as a rule file.
| + | |
| − | | + | |
| − | Enable processing a rule file in snort with the -c option, which takes the path to a rule file as its argument.
| + | |
| − | | + | |
| − | A snort rule is composed of two parts: the rule header and the rule options. The rule header contains the action of the rule, its protocol, source and destination IP addresses and netmasks, and information regarding the source and target ports. The option section contains the details of the alert messages and information concerning which parts of the packet should be examined.[ftp://petrinet.dvo.ru/pub/Vyatta/build-iso/pkgs/vyatta-snort/debian/my/snort_rules.html]
| + | |
| − | | + | |
| − | ====Rule Headers====
| + | |
| − | | + | |
| − | <b>Rule Actions</b>
| + | |
| − | | + | |
| − | There are available actions to a snort rule:
| + | |
| − | *alert: generates an alert flag of some kind when the rule is matched
| + | |
| − | *log: quietly logs the packet
| + | |
| − | *pass: forget about the packet
| + | |
| − | | + | |
| − | <b>Protocols</b>
| + | |
| − | | + | |
| − | There are three protocol options snort will look for:
| + | |
| − | *tcp
| + | |
| − | *udp
| + | |
| − | *icmp
| + | |
| − | | + | |
| − | These are pretty self-explanatory.
| + | |
| − | | + | |
| − | <b>IP Addresses</b>
| + | |
| − | | + | |
| − | Source and destination IP addresses to apply the rule to can be specified next, in the format 'source IP -> destination IP'. It is possible to use CIDR notation - for example, to indicate anything from the internl network, you can use 192.168.1.0/24. You can also prepend an IP address with the ! operator to indicate any packet NOT from the stated IP address.
| + | |
| − | | + | |
| − | <b>Port Number</b>
| + | |
| − | | + | |
| − | The final part of the header for a rule is the port reference, which can be in several formats. If a number is given by itself, the rule will apply only to that port. A range of ports can also be specified with the colon :.
| + | |
| − | | + | |
| − | [[Category:Countermeasures]][[Category:Information]]
| + | |
