Overview
In this article, we will explore what Snort is and how to configure it. Snort is one of the most popular methods for intrusion prevention and detection systems. As an open-source network security tool, it is widely used for its effectiveness in IPS and IDS.
What is Snort?
Snort is a free, open-source network intrusion prevention and detection system. It uses a rule-based language to perform protocol analysis, content searching/matching, and can be used to detect various attacks and probes, such as buffer overflows, stealth port scans, CGI attacks, SMB probes, OS fingerprinting attempts, and more.
Snort Rules
Snort rules provide the capability to detect attacks and malicious activities. You can write specific rules such as alert, log, disconnect, etc. The rules have a simple syntax. Furthermore, you can write all rules in the configuration file and can edit other systems as you wish. Snort has three different modes. These modes are; 1- Packet Sniffer. 2- Packet Logger. 3- NIPDS (Network Intrusion Prevention and Detection System).
Rule Syntax
>
Architecture: Snort Rule Syntax Rule Header alert—Rule action. Snort will generate an alert when the conditions are met. any—Source IP. (If “any” is used, Snort will look at all sources). any—Source Port. (If “any” is used, Snort will look at all ports). —>— Direction. From source to destination. any—Destination IP. Snort will look at all destinations on the protected network. any—Destination Port. Snort will look at all ports on the protected network.
Rule Options
msg:”ICMP test”—Snort will include this message in the alert. rev:1—Revision number. This option makes rule maintenance easier. classtype:icmp-event—Classify the rule as “ICMP-Event”, which is one of Snort’s predefined categories. This option aids in rule organization. What if we want to view requests for a specific target? It’s simple. Just replace “any” with the desired IP or port. For example, a Snort rule;
Code language: javascriptCopy
alert tcp 192.168.x.x any -> $HOME_NET 21 (msg:”FTP connection attempt”; sid:1000002; rev:1;)Here, $HOME_NET is defined in Snort.conf.