1. Network Security: Lab#5 Port Scanners and Intrusion Detection System
J. H. Wang
Dec. 3, 2013

2. Objectives To learn to use port scanners
Nmap
To introduce the ideas of intrusion detection system
Snort

3. Packages Used in this Lab
Nmap
Snort

4. Experiment Scenario Port scanners
Use port scanners to check the potential weakness in a system
Vulnerable ports
System types

5. Nmap Homepage: http://nmap.org/ Version:
6.40
Platforms: Linux/FreeBSD/Windows/MacOS X
Installation steps
Simply follow the instructions on screen

6. Example Usage for Nmap
Enter an IP address (or hostname) in [Target], and press [Scan]
Open ports will be listed
Type of OS will be detected
Many types of Scans
TCP scan
SYN scan
UDP scan
ACK scan
Window scan
FIN scan
Others: proxy scan, ICMP scan, …

7. Web-based Port Scanners
Examples

8. Nessus Homepage: http://www.tenable.com/products/nessus
Latest version: 5.2.4
Originally open source, but now proprietary by Tenable Network Security
Free to use in homes
Installation skipped

9. Intrusion Detection Systems
Host-based IDS (HIDS)
To monitor the status of files in a system
File integrity checking, log analysis
E.g. Tripwire, OSSEC
Network-based IDS (NIDS)
To detect the malicious network traffic such as DoS attacks
E.g. Snort

10. Tripwire Originally open source, but now commercial
Open source Tripwire available, which is based on previous open-source versions

11. OSSEC Originally open source, but acquired by Trend Micro
Will remain to be open source (as claimed by Trend Micro)

12. Snort Homepage: http://www.snort.org/ Latest version: 2.9.5.6
Platforms:
Linux/Windows
An open-source NIDS, which also requires WinPcap
Installation steps
Simply follow the instructions on screen
Note: In [Installation Options], please check [Enable IPv6 support] for demo of IDS functions

13. Example Usage for Snort
cd \snort
Sniffer mode: (default)
To show headers only: bin\snort -v
To show headers and data: bin\snort -vd
A more descriptive display: bin\snort -vde
Packet logger mode
To records packets in logging directory:
bin\snort -dev -l log
To log in binary mode
bin\snort -l log -b
To playback the packets in log
bin\snort -r packet.log

14. Network intrusion detection system mode
bin\snort -l log -c etc\snort.conf
(Some problems with the configuration file to work in Windows…)
You need to understand how to write the rules for intrusion detection…

15. Summary
Port scanners
Nmap
Intrusion detection system
Snort