SNORT Exposed Hakin9 StarterKit 01/2010 - Computer Science

Doug Chick printable: Notes of the Network Administrator
thousands of people directed to my private network
with over twenty offices connected, I am still waiting to
discover any long term damage. Privately one of the
techs from my ISP told me later that they thought the
intrusion came from China.
With the help of SNORT and EtherApe I was
immediately alerted to a flood of unwanted traffic to my
network. To me this reaffirmed the necessity of intrusion
detection programs, and also made me research how
many more types there are.
Types of Intrusion Detection Systems:
Intrusion prevention systems (ISP)
This device, also know as Intrusion Detection and
Prevention Systems are network security appliances
that monitor for malicious activity. This is a stand alone
appliance identifies suspicious activity, isolates and
logs it, and attempts to block.
Host-based intrusion detection systems (HIDS)
Host-based intrusion detection systems are installed on
the computer level and monitor the actual server it is
installed for suspicious activity, where ISPs operate on
the network and analyze packets.
Protocol-based intrusion detection systems (PIDS)
This detection system is generally added in front of
a web server and analyzes the HTTP, (and HTTPS)
protocol stream and or port numbers.
Application protocol-based intrusion detection
systems (APIDS)
APIDS typically are placed between servers and
monitors the application state, or more accurately the
protocols being passed between them. For example a
web server that might call on a database to populate a
webpage field.
I like SNORT because; one it is free, and two because of
the support and its sheer flexibility. (I know, that is three
things)
SNORT RULES…
Like with any intrusion detection device, SNORT has
Rules.
alert tcp any any -> 192.168.1.0/24 111 \
(content:”|00 01 86 a5|”; msg:”mountd access”;)
The rules are actions that tells Snort what to do when
it finds a packet that matches the rule criteria. There
are 5 default actions; alert, log, pass, activate, and
dynamic. If you are running Snort inline mode, there
are additional options which include; drop, reject, and
sdrop.
1. alert – generate an alert using the selected alert
method, and then log the packet
2. log – log the packet
3. pass – ignore the packet
4. activate – alert and then turn on another dynamic
rule
5. dynamic – remain idle until activated by an activate
rule , then act as a log rule
6. drop – block and log the packet
7. reject – block the packet, log it, and then send a
TCP reset if the protocol is TCP or an ICMP port
unreachable message if the protocol is UDP.
8. sdrop – block the packet but do not log it.
If you want to learn more about SNORT, I recommend
you visit there site at: www.snort.org
I know there are other NIDS programs out there,
and I’m sure they are just as good as SNORT, but as a
network administrator/engineer this particular program
has already proven itself to me.
EtherApe: Gorilla Virtual Warfare
As I mentioned before, another program I like is
EtherApe. EtherApe is a graphical network monitor
for UNIX modeled operating systems. It doesn’t have
the same features as SNORT, but what is does do is
gives you a graphical overview, on what is going on in
your network. I run EtherApe on a large screen monitor
above my desk. When trouble comes, I can see an
immediate flash of color that warns me that there is
a possible situation on my network. This seemingly
simple program has called me to action a couple of
times. EtherApe has the ability to filter just the port
number you want to monitor, or by default all of them.
Like the name implies it works on an Ethernet network,
but it also works with FDDI, Token Ring, ISDN, PPP,
and SLIP.
DOUGLAS CHICK
Douglas Chick is a Director of Information Systems for a large
company in the Orlando FL area. Although he introduces
himself as a Network Engineer/Administrator. As with many
computer people, Doug holds an MCSE and CCNA certication.
Doug rst became known on the Internet in May of 2000 for a
series of articles about Microsoft retiring the NT4 MCSE that
were published on over 30 Internet Magazines. With his humor
and insightful look into the world on computer professionals,
he receives a great deal of attention from other computer
professionals around the world. And is proud to admit that less
that one percent are in response for his many typo’s and misspellings.
For more visit: www.TheNetworkAdministrator.com
www.hakin9.org SNORT
7