Difference between revisions of "NIDS"
(→Snort) |
(→Snort) |
||
| Line 6: | Line 6: | ||
Snort is a packet sniffer and intrusion detection system that can be used to add a layer of surveillance to your system. In this way, it is similar to tcpdump, but with some more advanced rule-setting capabilities for detecting certain forms of packets. Snort is one of the most widely used IDSes under Linux, and a port exists for the Windows [[Operating System]]. | Snort is a packet sniffer and intrusion detection system that can be used to add a layer of surveillance to your system. In this way, it is similar to tcpdump, but with some more advanced rule-setting capabilities for detecting certain forms of packets. Snort is one of the most widely used IDSes under Linux, and a port exists for the Windows [[Operating System]]. | ||
| + | |||
| + | ===Basic Packet Sniffing Utilities=== | ||
| + | |||
| + | Once installed, snort can be set up with basic packet sniffing functionality simply by typing "snort" into a terminal or command prompt. It will run in the default mode using the default interface - for me, this is eth0, the wired connection. A new interface can be specified with the -i option. For example, to run snort on the wireless interace: | ||
| + | |||
| + | {{code|text= | ||
| + | snort -i wlan0 | ||
| + | }} | ||
| + | |||
| + | ===Rules=== | ||
[[Category:Countermeasures]][[Category:Information]] | [[Category:Countermeasures]][[Category:Information]] | ||
Revision as of 04:32, 29 November 2011
Network layer Intrusion Detection Systems
NIDS are an IDS that monitor all traffic to and from all network devices. It will read incoming packets looking for suspicious patterns. Popular NIDs such as snort and Cisco IDS are used often-times in conjunction with a firewall to form an IPS. Also commonly used to send information to a SIM or SIMS
Snort
Snort is a packet sniffer and intrusion detection system that can be used to add a layer of surveillance to your system. In this way, it is similar to tcpdump, but with some more advanced rule-setting capabilities for detecting certain forms of packets. Snort is one of the most widely used IDSes under Linux, and a port exists for the Windows Operating System.
Basic Packet Sniffing Utilities
Once installed, snort can be set up with basic packet sniffing functionality simply by typing "snort" into a terminal or command prompt. It will run in the default mode using the default interface - for me, this is eth0, the wired connection. A new interface can be specified with the -i option. For example, to run snort on the wireless interace:
|
snort -i wlan0 |
