Snort (Packet Sniffering and Logging mode) Part I

Discussion regarding the installation and configuration of Linux distributions.

Snort (Packet Sniffering and Logging mode) Part I

Postby nasacis » Fri Aug 01, 2008 11:08 am

Snort is a free and open source Network Intrusion prevention system (NIPS) and network intrusion detection (NIDS) capable
of performing packet logging and real-time traffic analysis on IP networks. Snort was written by Martin Roesch and is now
developed by Sourcefire, of which Roesch is the founder and CTO. Integrated enterprise versions with purpose built hardware
and commercial support services are sold by Sourcefire.

Snort performs protocol analysis, content searching/matching, and is commonly used to actively block or passively detect
a variety of attacks and probes, such as buffer overflows, stealth port scans, web application attacks, SMB probes, and OS
fingerprinting attempts, amongst other features. The software is mostly used for intrusion prevention purposes, by
dropping attacks as they are taking place. Snort can be combined with other software such as SnortSnarf, sguil, OSSIM,
and the Basic Analysis and Security Engine (BASE) to provide a visual representation of intrusion data. With patches for
the Snort source from Bleeding Edge Threats, support for packet stream antivirus scanning with ClamAV and network
abnormality with SPADE in network layers 3 and 4 is possible with historical observation. ( These patches seem to be no
longer maintained)
http://sguil.sourceforge.net/
http://base.secureideas.net/
http://www.sourcefire.com/
http://www.activeworx.org/
http://www.appliedwatch.com/
http://www.aanval.com/
http://www.skynet-solutions.net/easyids/

Gathering the Required Software
Snort www.snort.org
This paper is based on the most recent version of Snort, v2.8.2.1

Snort requires lipbcap for packet capturing. BSD derivatives typically include libpcap; Linux typically does not, so libpcap
should be installed before proceeding to install snort

Installation

# cd /usr/src
# wget http://www.snort.org/dl/current/snort-2.8.2.1.tar.gz
# tar zxvf snort-2.8.2.1.tar.gz
# cd snort-2.8.2.1/
# ./configure
# make
# make check --to run any self tests
# make install

Using Snort
To see how snort can be used to read packets off the wire try the following command:
Snort works in 3 Modes but i describe 2 modes and 3rd mode will be upload shorlty

1. Packet Sniffer Mode
- snort -v (TCP/UDP/ICMP/IP) Headers
- snort -vd (application layer)
- snort -vde (data-link layer (MAC))
- snort -vde -i interface src host ipaddress and dst host ipaddress # see the example on very next line
snort -vde -i eth0 src host 192.168.2.30 and dst host 192.168.2.31
- snort -vde -i interface src host ipaddress and dst port portno # see the exaple on very next line
snort -vde -i eth0 src host 192.168.2.31 and dst port 22
2. Packet Logger Mode
ASCII Logging
- mkdir /temp
- cd /temp
- snort -vde -l ./
- snort -vde -l ./ -i interface src host ipaddress and dst port portno
- snort -vde -l ./ -i interface src host ipaddress
Binary Logging
- snort -b -L snort_binary.log -l ./ -i interface src host ipaddress
- snort -dev -r snort_binary.log.no =Read Binary file
- snort -dev -r snort_binary.log.no src host ipaddress and dst port portno =Read Binary file
- snort -dev -r snort_binary.log.no src host ipaddress and dst port not portno =Read Binary file
- Tie Snort to multiple interfaces
- snort -b -L snort_eth0 -i eth0 <BPFs>
- snort -b -L snort_eth1 -i eth1 <BPFs>

Notice snort even generates a nice table of statistics. Unfortunately, snort cannot provide packet loss statistics under
Linux but is able to do so under both FreeBSD and Solaris.

NIDS and NIPS mode will be upload very shortly, be paitent :)

For any comments, feedback and correction, kindly mail me nafees29@gmail.com

Regards
Nafees Ahmed
Cell: +92.300.8653568
UAN: 041-111432432
Nexlinx Faisalabad
www.nexlinx.net.pk
nafees29@gmail.com
nasacis
Battalion Havaldaar Major
 
Posts: 269
Joined: Sat Dec 13, 2003 3:58 pm
ICQ: 22342780
Website: http://www.homepages.com.pk/nafeesahmed
WLM: nafees21
Yahoo Messenger: n_ahmad.rm
Location: Faisalabad

Postby lambda » Fri Aug 01, 2008 12:47 pm

a lot of people will just need to install the snort package, part of their distribution.
Watch out for the Manners Taliban!
Isn't it amazing how so many people can type "linuxpakistan.net" into their browsers but not "google.com"?
lambda
Major General
 
Posts: 3452
Joined: Tue May 27, 2003 7:04 pm
Website: http://www.hungry.com/~fn/
Location: Lahore

Postby nasacis » Fri Aug 01, 2008 2:09 pm

sorry, i could not understand what you wanna say ?
Nafees Ahmed

Cell: +92.300.8653568

UAN: 041-111432432

Nexlinx Faisalabad

www.nexlinx.net.pk

nafees29@gmail.com
nasacis
Battalion Havaldaar Major
 
Posts: 269
Joined: Sat Dec 13, 2003 3:58 pm
ICQ: 22342780
Website: http://www.homepages.com.pk/nafeesahmed
WLM: nafees21
Yahoo Messenger: n_ahmad.rm
Location: Faisalabad

Postby lambda » Fri Aug 01, 2008 4:56 pm

apt-get install snort

yum install snort

etc.
Watch out for the Manners Taliban!
Isn't it amazing how so many people can type "linuxpakistan.net" into their browsers but not "google.com"?
lambda
Major General
 
Posts: 3452
Joined: Tue May 27, 2003 7:04 pm
Website: http://www.hungry.com/~fn/
Location: Lahore

Postby nasacis » Fri Aug 01, 2008 6:20 pm

compiling packages from source are most flexible than precompiled packages
Nafees Ahmed

Cell: +92.300.8653568

UAN: 041-111432432

Nexlinx Faisalabad

www.nexlinx.net.pk

nafees29@gmail.com
nasacis
Battalion Havaldaar Major
 
Posts: 269
Joined: Sat Dec 13, 2003 3:58 pm
ICQ: 22342780
Website: http://www.homepages.com.pk/nafeesahmed
WLM: nafees21
Yahoo Messenger: n_ahmad.rm
Location: Faisalabad

Postby lambda » Sat Aug 02, 2008 12:30 am

...except nothing you've pasted up above makes use of any special configuration options that are not provided by precompiled packages.
Watch out for the Manners Taliban!
Isn't it amazing how so many people can type "linuxpakistan.net" into their browsers but not "google.com"?
lambda
Major General
 
Posts: 3452
Joined: Tue May 27, 2003 7:04 pm
Website: http://www.hungry.com/~fn/
Location: Lahore

Postby nasacis » Sat Aug 02, 2008 10:51 am

because, i just used snort in simple configuration. i will upload update version of this how to very shortly with special configuration options which would not be available with precompiled packages
Nafees Ahmed

Cell: +92.300.8653568

UAN: 041-111432432

Nexlinx Faisalabad

www.nexlinx.net.pk

nafees29@gmail.com
nasacis
Battalion Havaldaar Major
 
Posts: 269
Joined: Sat Dec 13, 2003 3:58 pm
ICQ: 22342780
Website: http://www.homepages.com.pk/nafeesahmed
WLM: nafees21
Yahoo Messenger: n_ahmad.rm
Location: Faisalabad


Return to “%s” Installation

Who is online

Users browsing this forum: No registered users and 0 guests

cron