1. USENIX LISA ‘99 Conference © Copyright 1999, Martin Roesch Snort - Lightweight Intrusion Detection for Networks Martin Roesch

2. USENIX LISA ‘99 Conference © Copyright 1999, Martin Roesch Introducing Snort Snort is: –Small (~110K source distribution) –Portable (Linux, Solaris, *BSD, IRIX, HP-UX) –Fast (High probability of detection for a given attack on “average” networks) –Configurable (Easy rules language, many reporting/logging options) –Free (GPL/Open Source Software)

3. USENIX LISA ‘99 Conference © Copyright 1999, Martin Roesch Snort Design Packet sniffing network intrusion detection system Libpcap-based sniffing interface Rules-based detection engine Multiple output options –decoded logs, tcpdump formatted logs –real-time alerting to syslog, file, winpopup

4. USENIX LISA ‘99 Conference © Copyright 1999, Martin Roesch Detection Engine Rules form “signatures” Modular detection elements are combined to form these signatures Anomalous activity detection is possible –stealth scans, OS fingerprinting, invalid ICMP codes, etc Rules system is very flexible, and creation of new rules is relatively simple

5. USENIX LISA ‘99 Conference © Copyright 1999, Martin Roesch Rules Format alert tcp !10.1.1.0/24 any -> 10.1.1.0/24 any (flags: SF; msg: “SYN-FIN Scan”;) Two sections to a rule rule header: alert tcp !10.1.1.0/24 any -> 10.1.1.0/24 any rule options: (flags: SF; msg: “SYN-FIN Scan”;) Rule headers and options can be strung together in any combination Current version of Snort (1.3.1) has fourteen rule options available

6. USENIX LISA ‘99 Conference © Copyright 1999, Martin Roesch Rule Header Features IP addresses –negation, CIDR blocks TCP/UDP ports –negation, ranges, greater than/less than uni/bi-directional port/address consideration

7. USENIX LISA ‘99 Conference © Copyright 1999, Martin Roesch Rule Option Features IP TTL IP ID Fragment size TCP Flags TCP Ack number TCP Seq number Payload size Content Content offset Content depth Session recording ICMP type ICMP code Alternate log files

8. USENIX LISA ‘99 Conference © Copyright 1999, Martin Roesch Uses for Snort Standard packet sniffing NIDS Honeypot monitor Scan detection/traps Other fun stuff

9. USENIX LISA ‘99 Conference © Copyright 1999, Martin Roesch Packet Sniffing NIDS Load up a good rules set and let it run! –www.whitehats.com Automatically generates alerts and logs full packet data Alternative alerting/actions can be handled by something like Swatch –email alerts, active response, etc

10. USENIX LISA ‘99 Conference © Copyright 1999, Martin Roesch Honeypot Monitor Honeypots are “deception systems” that perform intrusion detection by inclusion –Gets rid of all the false alarms! Use Snort’s filtering capability to log only the traffic (but all the traffic!) going to the honeypot Post process the data with a good ruleset

11. USENIX LISA ‘99 Conference © Copyright 1999, Martin Roesch Scan Detection/Traps Snort has no formal port scan detection mechanism Setup rules to log traffic to known closed ports & unused addresses Poor man’s honeypot/port scan detector Alert tcp any any -> 10.1.1.0/24 100:600 (flags: S; msg: “TRAP!”;)

12. USENIX LISA ‘99 Conference © Copyright 1999, Martin Roesch Other Fun Stuff Snort is a packet sniffer, can be used to analyze traffic in real-time Motivated people can write rules to pick up all sorts of naughty things –SQL/ODBC, ActiveX, Java/JavaScript, Macro Viruses

13. USENIX LISA ‘99 Conference © Copyright 1999, Martin Roesch Other Fun Stuff (Cont.) SHADOW sensor replacement SHADOW is a free NIDS based on tcpdump Snort can use the SHADOW BPF rule set, plus it’s own! Gains: –real-time alerting, payload analysis, rules simplicity, post-processing, etc.

14. USENIX LISA ‘99 Conference © Copyright 1999, Martin Roesch The Future! Snort 1.5-2.0 –New plugin architecture –Write detection modules and add them to rule set –Hooks for preprocessors ip defrag, TCP stream reassembly, statistics, etc –Hooks for backend/output database, SNMP, tunnels, etc.

15. USENIX LISA ‘99 Conference © Copyright 1999, Martin Roesch FIN Get Snort from: E-mail me: Writing Snort rules: