1. IDS Mike O’Connor Eric Tallman Matt Yasiejko

2. Overview IDS defined IDS defined What it does What it does Sample logs Sample logs Why we need it Why we need it What it doesn’t do What it doesn’t do Setup Setup Alternatives Alternatives

3. IDS defined IDS = Intrusion Detection System IDS = Intrusion Detection System Cisco IDS-4215 Cisco IDS-4215 Placed on the switch Placed on the switch IDS vs IPS IDS vs IPS IDS = detection; “passive” IDS = detection; “passive” IPS = prevention; “active” IPS = prevention; “active” Signature driven (misuse detection) Signature driven (misuse detection)

4. IDS defined Used to detect traffic not captured by conventional firewalls Used to detect traffic not captured by conventional firewalls Network vs. Host IDS Network vs. Host IDS Network = examines traffics and monitors multiple hosts Network = examines traffics and monitors multiple hosts Host = analyzes system calls, file modifications, etc Host = analyzes system calls, file modifications, etc Misuse (signature based) vs. anomaly (self-learn) Misuse (signature based) vs. anomaly (self-learn)

5. What it does… Analyzes network traffic that has been sent to or from FA 0/24 Analyzes network traffic that has been sent to or from FA 0/24 Uses signature database to identify problematic traffic Uses signature database to identify problematic traffic Custom signatures may be added Custom signatures may be added False positives are quite possible False positives are quite possible DNS requests DNS requests IP logging, block IP, allow IP, etc IP logging, block IP, allow IP, etc Detects port scans Detects port scans

6. DNS request logged

7. Signature 4003 details

8. Port scan detected

9. Why we need IDS Nmap sweeps Vulnerability sought constantly Many attack types Above is one type of TCP sweep (SYN packets)

10. What our IDS doesn’t do Intrusion Prevention!! Intrusion Prevention!! The administrator must take action The administrator must take action Does not log traffic that does not pass through FA 0/24 Does not log traffic that does not pass through FA 0/24 This was a choice This was a choice Internal traffic is undetected at this time Internal traffic is undetected at this time

11. Setup Used CLI for IDS configuration Used CLI for IDS configuration Setup IP, gateway, name, netmask Setup IP, gateway, name, netmask Set access list Set access list Console only at the moment (134.198.161.100) Console only at the moment (134.198.161.100)

12. SPAN Switched Port ANalyzer Switched Port ANalyzer Mirrors 0/24 onto 0/23 Mirrors 0/24 onto 0/23

13. Monitor session on the switch #configure terminal #monitor session 1 source interface fastethernet 0/24 both #monitor session 1 destination interface fastethernet 0/23 #end

14. Alternatives Snort Snort Software solution to IDS/IPS Software solution to IDS/IPS Traffic analysis Traffic analysis Packet logging Packet logging Detects port scans, buffer overflows, etc Detects port scans, buffer overflows, etc IPS IPS