1. Snort The Lightweight Intrusion Detection System

2. The other games in town Heavyweight systems: Stateful firewalls: Example: Checkpoint Firewall One Example: Checkpoint Firewall One Commercial network intrusion detection systems: Example: Network Flight Recorder (NFR) Example: Network Flight Recorder (NFR)

3. The Art of Intrusion Detection: n Know n Know the protocols. n Watch n Watch the web. n Set n Set up your IDS monitor. n Install n Install and tune Snort. n Set n Set up your switches. n Watch n Watch and process logs.

4. Know the protocols

5. Watch the web

6. www.snort.orgwww.securityfocus.comcsrc.nist.govwww.sans.orgwww.cert.org

7. Set up your IDS monitor

8. Generic Intel CPU UNIX-like O/S with LIBPCAP The software

9. Install and tune Snort Compile Download Tune the rules

10. Set up your switches User PC Cross-over jumper The Default VLAN or ELAN Remote Switch Local Switch Snort Box Management VLAN

11. Set up your switches remote-switch# set vlan 2 port 3/2 remote-switch# set vlan 2 port 3/3 remote-switch# set span 1 3/1 create local-switch# set vlan 2 port 4/1 local-switch# set vlan 2 port 4/2

12. Watch and process logs n There are lots of PERL programs. n Snort can send a WINPOPUP via SMB. n Snort can log to an MSQL database. n Get fancy by going through syslog. n Tip: keep systems in sync with NTP.

13. Snort rule anatomy alert tcp any any - 10.1.1.0/24 80 \ (content: "/cgi-bin/phf"; msg: "PHF probe!";) (content: "/cgi-bin/phf"; msg: "PHF probe!";) alert tcp any any - 10.1.1.0/24 6000:6010 \ (msg: "X traffic";) (msg: "X traffic";)

14. Snort rule anatomy IMAP attack:

15. Snort rule anatomy alert tcp any any - 192.168.1.0/24 143 \ (content:"|E8C0 FFFF FF|/bin/sh"; msg: \ (content:"|E8C0 FFFF FF|/bin/sh"; msg: \ "New IMAP Buffer Overflow detected!";) "New IMAP Buffer Overflow detected!";)

16. Operational hint Run from /etc/inittab with respawn option: snort:5:respawn:/usr/local/bin/snort or a shell program: #!/bin/sh: while true do /bin/date > /var/log/snort-restart.log /bin/date > /var/log/snort-restart.log /usr/local/bin/snort /usr/local/bin/snortdone

17. Thank you