1. Snort Intrusion Detection

2. What is Snort Packet Analysis Tool Most widely deployed NIDS Initial release by Marty Roesch in 1998 Current version 2.4.4 as of April 17th, 2006

3. Features Small Package – 2.7 M for source Cross Platform Open Source Backed by Sourcefire Fast (High rate of detection on average networks) Configurable

4. Design Packet Analysis Pipline Data Acquisition DecodePreprocess DetectAction

5. Design Engine Uses Rules to form “signatures” Modular Detection elements to form specific signatures Detect Anomaly Activity Easily updateable

6. Different Modes Packet Sniffer Packet Logger NIDS Mode Inline Mode

7. Rules Two Parts – Rule Header – Rule Options

8. Rule Header alert tcp $BAD any -> $GOOD any Rule action Protocol Src. CIDR Src. Port Direction Dest. CIDR Dest. Port alert tcp !10.1.1.0/24 any -> 10.1.1.0/24 any

9. Rule Options (flags: SF; msg: “SYN-FIN scan”;) KeywordSeparatorArgumentDelimiter

10. Common Rule Options IP TTL IP ID Fragment size TCP Flags TCP Ack number TCP Seq number Payload size Content Content offset Content depth Session recording ICMP type ICMP code Alternate log files

11. Make Custom Rules Detect String alert tcp any any -> any any \ (content: clemson; msg: detected clemson!;)

12. Output Log all the alerts Real-time alerts Several different types – Syslog – Plain text – Databases – Unified output

13. Common Options OptionDescription -A fastFast alert mode. Writes the alert in a simple format with a timestamp, alert message, source and destination IPs/ports. -A fullFull alert mode. This is the default alert mode and will be used automatically if you do not specify a mode. -A unsockSends alerts to a UNIX socket that another program can listen on. -A noneTurns off alerting. -A console Sends “fast-style” alerts to the console (screen). -A cmgGenerates “cmg style” alerts.

14. Tools for Snort Acid SnortSnarf Snort Alert Monitor (SAM) Snortalog Guardian DeMarc PureSecure IDSCenter (Windoze)

15. Resources Snort.org – www.snort.org/dl (downloads) www.snort.org/dl BleedingEdge – www.bleedingsnort.com/ Sourcefire – www.sourcefire.com