1. SNORT! Among other things

2. Description Open source ids/ips Real-time analysis: alerting, blocking, logging Real-time response: alerting, session sniping, packet logging, session dropping Written in C

3. Functional Modes Packet Sniffer (like tcpdump) Packet Logger (for network traffic debugging) IDS/IPS

4. Usage Snort –[options] Ex – snort 192.168.1.0/24 –d –v host 192.168.1.1 – Records the traffic to and from host 192.168.1.1

5. Rules /etc/snort/rules /attack-responses.rules /backdoor.rules /bad-traffic.rules /chat.rules /content-replace.rules /ddos.rules

6. BASE Basic Analysis and Security Engine Web-based analysis engine to search and process a database of security events ‘Google for Snort’ Included w/ snort Needs to be set up properly, should not be externally visible ideally.

7. Other Stuff…

8. Snort rule parser (python ) /pentest/exploits/inguma/lib/libsnort.py Part of the Inguma Penetration Testing Toolkit Script includes handy and concise way to parse snort rules – could help w/ snort extensions

9. Header Files (*.h) /usr/local/src/snort_dynamicsrc /stream_api.h seems to define a lot of the juicy packet handling functions

10. Logging /var/log/snort Pretty typical location for logging, not really sure at this point what is stored here.

11. Other sources of info BRO – Includes utility to use snort rules SysLog – not an IDS, just provides detailed system info Snort Rules – http://www.ussrback.com/docs/papers/IDS/snort _rules.htm