SNORT! Among other things

Description Open source ids/ips Real-time analysis: alerting, blocking, logging Real-time response: alerting, session sniping, packet logging, session dropping Written in C

Functional Modes Packet Sniffer (like tcpdump) Packet Logger (for network traffic debugging) IDS/IPS

Usage Snort –[options] Ex – snort /24 –d –v host – Records the traffic to and from host

Rules /etc/snort/rules /attack-responses.rules /backdoor.rules /bad-traffic.rules /chat.rules /content-replace.rules /ddos.rules

BASE Basic Analysis and Security Engine Web-based analysis engine to search and process a database of security events ‘Google for Snort’ Included w/ snort Needs to be set up properly, should not be externally visible ideally.

Other Stuff…

Snort rule parser (python ) /pentest/exploits/inguma/lib/libsnort.py Part of the Inguma Penetration Testing Toolkit Script includes handy and concise way to parse snort rules – could help w/ snort extensions

Header Files (*.h) /usr/local/src/snort_dynamicsrc /stream_api.h seems to define a lot of the juicy packet handling functions

Logging /var/log/snort Pretty typical location for logging, not really sure at this point what is stored here.

Other sources of info BRO – Includes utility to use snort rules SysLog – not an IDS, just provides detailed system info Snort Rules – _rules.htm