Scribd
Upload
47 views10 pages

Intrusion Detection System

Snort is a free and open source intrusion detection system that monitors network traffic, scans for protocol anomalies and packet signatures that could indicate attacks. It is best placed at natural choke points like areas of single traffic flow due to network topology, or artificial choke points between intranet trusted and untrusted zones. Snort works using rules to detect signatures like the example given, but can generate false positives. Its monitoring console BASE shows statistics on alerts, their categories, most frequent source/destination ports, and more. It was used in an example to detect propagation of the Bagle worm variant across workstations by monitoring for a specific gif file in traffic.

Uploaded by

GowriShankar Muthukrishnan
Copyright
© Attribution Non-Commercial (BY-NC)
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PPT, PDF, TXT or read online on Scribd
47 views10 pages

Intrusion Detection System

Snort is a free and open source intrusion detection system that monitors network traffic, scans for protocol anomalies and packet signatures that could indicate attacks. It is best placed at natural choke points like areas of single traffic flow due to network topology, or artificial choke points between intranet trusted and untrusted zones. Snort works using rules to detect signatures like the example given, but can generate false positives. Its monitoring console BASE shows statistics on alerts, their categories, most frequent source/destination ports, and more. It was used in an example to detect propagation of the Bagle worm variant across workstations by monitoring for a specific gif file in traffic.

Uploaded by

GowriShankar Muthukrishnan
Copyright
© Attribution Non-Commercial (BY-NC)
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PPT, PDF, TXT or read online on Scribd
You are on page 1/ 10

Intrusion Detection System

Snort

What is Snort?

Free and Open Source Intrusion Detection System


Monitor network traffic Scan for protocol anomalies Scan for packet payload signatures that represent potential attacks, worms, and unusual activities

Monitoring consoles available Can be configured as an IPS

Where should it be placed?

Snort Tap Placement

Natural Choke Points


Areas

where the network topology creates a single traffic path due to logical topology of the network

Artificial Choke Points


Exist

Intranet Trust/Un-trust Zone Boundaries


Similar

to Natural Choke Points but are intranetwork

How does it work?

Snort Rules
Primarily a signature based detection engine Example:

alert

tcp $TELNET_SERVERS 23 -> $EXTERNAL_NET any (msg:"TELNET root login"; flow:from_server,established; content:"login|3A| root"; classtype:suspicious-login; sid:719; rev:7;)

While indicative of attacks, leaks, and protocol violations, false positives are generated

How to monitor?

BASE (Basic Analysis and Security Engine)


Number of unique alerts Alerts ordered by category Todays alert Most frequent src/dest ports

BASE Main Screen

BASE Policy Violations

Worm Propagation Analysis Example

Multiple Layers of Antivirus checkers in place: workstations, servers, email-stores, and email gateways Most active updating checkers gets new signatures every 15 minutes On September 2005, 3 bagle variants were released quickly AV companies alerted us, but workstations were affected Which of the 5000 workstations were affected?

Worm Propagation Analysis Example

alert tcp any any -> any any (msg:"Potential Bagle Propagation"; content:"osa6.gif"; classtype:policyviolation; sid:1000003; rev:3;)

Conclusion
Snort provides another tool in the toolkit and can help provide information about exactly whos talking to who on the network Security is a process, not a product

You might also like