Snort & ACID

UTSA IS 6973 Computer Forensics SNORT

UTSA IS 6973 Computer Forensics Overview Tool Description Where You Can Find it Applicability to Forensics Tool Use/Screen Views Observations Lessons Learned

UTSA IS 6973 Computer Forensics Technical Description What is Snort? –“Snort is an open source network intrusion detection system, capable of performing real-time traffic analysis and packet logging on IP networks.” –Performs protocol analysis, content searching/matching –Can detect all sorts of probes and attacks

UTSA IS 6973 Computer Forensics Where to Find the Tool Snort –

UTSA IS 6973 Computer Forensics How Snort Supports Forensics Snort is a packet sniffer on steroids. Can be placed at different points in a network to provide real time information. By logging alerts and rule violations, a systems administrator can be mindful of attacks in progress or research past incidents.

UTSA IS 6973 Computer Forensics Snort Usage Run from the command line or as a Windows Service. Lots of options

UTSA IS 6973 Computer Forensics Snort Options USAGE: snort [-options] snort /SERVICE /INSTALL [-options] snort /SERVICE /UNINSTALL snort /SERVICE /SHOW Options: -A Set alert mode: fast, full, console, or none (alert file ale rts only) -b Log packets in tcpdump format (much faster!) -c Use Rules File -C Print out payloads with character data only (no hex) -d Dump the Application Layer -e Display the second layer header info -E Log alert messages to NT Eventlog. (Win32 only) -f Turn off fflush() calls after binary log writes -F Read BPF filters from file -h Home network = -i Listen on interface -I Add Interface name to alert output -k Checksum mode (all,noip,notcp,noudp,noicmp,none) -l Log to directory

UTSA IS 6973 Computer Forensics More Snort Options -L Log to this tcpdump file -n Exit after receiving packets -N Turn off logging (alerts still work) -o Change the rule testing order to Pass|Alert|Log -O Obfuscate the logged IP addresses -p Disable promiscuous mode sniffing -P Set explicit snaplen of packet (default: 1514) -q Quiet. Don't show banner and status report -r Read and process tcpdump file -R Include 'id' in snort_intf.pid file name -s Log alert messages to syslog -S Set rules file variable n equal to value v -T Test and report on the current Snort configuration -U Use UTC for timestamps -v Be verbose -V Show version number -W Lists available interfaces. (Win32 only) -w Dump management and control frames -X Dump the raw packet data starting at the link layer -y Include year in timestamp in the alert and log files -z Set assurance mode, match on established sesions (for TCP) -? Show this information are standard BPF options, as seen in TCPDump

UTSA IS 6973 Computer Forensics Snort in Action

UTSA IS 6973 Computer Forensics Snort Raw Output

UTSA IS 6973 Computer Forensics Snort Logs – Better Information

UTSA IS 6973 Computer Forensics Observations of Snort - Good FREE! Large user base Community provides constant rule updates Free tools to provide log analysis and /pager alerts

UTSA IS 6973 Computer Forensics Observations of Snort - Bad UNIX tool ported to Windows; behaves like a UNIX tool –Difficult to configure Cryptic command line driven interface All configuration is driven by files Lacks standardized support

UTSA IS 6973 Computer Forensics Lessons Learned - Snort You get what you pay for! Documentation for running Snort on XP is inconsistent and out of date. Since the solution comprises several free tools, each tool has separate issues with XP.

UTSA IS 6973 Computer Forensics ACID

UTSA IS 6973 Computer Forensics Overview Tool Description Where You Can Find it Applicability to Forensics Tool Use/Screen Views Observations Lessons Learned

UTSA IS 6973 Computer Forensics Technical Description What is ACID? –The Analysis Console for Intrusion Databases (ACID) –PHP-based analysis engine to search and process a database of security events generated by various IDSes, firewalls, and network monitoring tools.

UTSA IS 6973 Computer Forensics Where to Find the Tool ACID –

UTSA IS 6973 Computer Forensics How ACID Supports Forensics ACID helps to make sense of Snort data in a visual manner. Can help analyze trends and help filter out the noise by categorizing attacks and IP addresses. Query-builder and search interface. Can provide alerts when events occur.

UTSA IS 6973 Computer Forensics ACID Usage Acid runs as a set of PHP web pages under IIS or Apache. Reports, alerts, and information is accessed through the web interface

UTSA IS 6973 Computer Forensics ACID at Work

UTSA IS 6973 Computer Forensics Alert Screen

UTSA IS 6973 Computer Forensics Alert Screen - Detail

UTSA IS 6973 Computer Forensics Alert Screen – Graph

UTSA IS 6973 Computer Forensics Observations of ACID - Good FREE! Nice graphical interface written in PHP, therefore user community to rely on. Free tools to provide log analysis and /pager alerts. Helps sort through all the info from Snort.

UTSA IS 6973 Computer Forensics Observations of ACID - ACID Lacks standardized support Lots of options to become familiar with

UTSA IS 6973 Computer Forensics Lessons Learned – ACID You get what you pay for! Configuration is file driven, no GUI. Most documentation for running ACID pertains to Apache servers and took some searching to run on IIS. Reliance on PHP means that any interesting aspects on running PHP on Windows had to be sorted through.

UTSA IS 6973 Computer Forensics Summary Both Snort and ACID are excellent tools for Intrusion Detection. Open Source means (hopefully) constant improvements Free tools for companies that cannot afford tools or services provided by other companies. Can be time frustrating to deal with and requires an administrator with the time and expertise to master all the options and create a working system.