230 likes | 661 Views
Snort. Introduction to Snort’s Working and configuration file. Three modes of snort. Snort can be configured in three modes Sniffer Packet Logger Network Intrusion Detection System. Sniffer mode. In sniffer mode, snort act as a sniffer like tcpdump, ethereal
E N D
Snort Introduction to Snort’s Working and configuration file
Three modes of snort Snort can be configured in three modes • Sniffer • Packet Logger • Network Intrusion Detection System
Sniffer mode • In sniffer mode, snort act as a sniffer like tcpdump, ethereal • Following options of snort are useful for sniffer mode. • -d Dump the app layer data when displaying • -e Display the link layer packet headers • -v prints packet to the console
Packet logger mode • In packet logger mode, snort just logs the packet which can later be used for running analysis, NIDS mode of snort and otherwise • Following options of snort are useful for sniffer mode. • -l Followed by directory: this will log the packets to particular directory • -dev Can also be used for logger mode, but they are slow. • -b logs the packets in binary. This is recommended for packet logger mode, as it is fast
NIDS mode • NIDS mode is started with -c snort.conf • Different ways to start snort are following • snort -devl ./log -h 192.168.1.0/24 -c snort.conf • snort -bl ./log -h 192.168.1.0/24 -c snort.conf • snort -b -A fast -c snort.conf • snort -b -l ./log -c snort.conf –o
Snort.conf Configuration File defines the following • Network Variables • Preprocessors and their variables • Classification Files • Reference Files • Rules
Snort.conf (II) Network Variables Different network variables are set. Examples are given below var HTTP_PORTS 80 var TELNET_SERVERS 10.1.1.1/29
Snort.conf (III) Preprocessors Pre-compiled set of functions which handle detection. Preprocessors are fast but cannot be used from within a rule.
Snort.conf (IV) Classification File In this file, priorities are stored for different attacks. 1 means highest priority or dangerous attack. Sample from classification file • config classification: attempted-dos,Attempted Denial of Service,2 • config classification: successful-dos,Denial of Service,2 • config classification: attempted-user,Attempted User Privilege Gain,1 • config classification: unsuccessful-user,Unsuccessful User Privilege Gain,1
Snort.conf (V) Reference File This includes reference URLs for different software. The reference is defined in rules, so that a URL is also displayed for administrators to rectify the problem.
Snort.conf (VI) Rules Rules are defined in several files which are included in snort.conf. The updated set of rules can be downloaded from snort.org
Modify Snort Snort provides three mechanisms to modify its functionality. • Plug-ins Two types of plug-ins • Output plug-ins • Detection plug-ins • Preprocessors • Source Code Modification