[Day 2] 1. Overview of SNORT

Introduction to Intrusion Detection System (IDS)

• An Intrusion Detection System (IDS) monitors network traffic and allows only authorized packets into the system.
• The definition of intrusion varies across organizations and is determined by their respective policies.
• Authorized and unauthorized traffic is also defined by the organization's specific rules.

---

What is SNORT?

• SNORT is an Open Source Intrusion Detection System.
• It can operate in multiple modes:
  • Packet Capturing or Sniffing Mode: Used to verify SNORT's installation and functionality.
  • NIDS (Network Intrusion Detection System) Mode: For detecting intrusions and analyzing network traffic.
  • Packet Logging Mode: Logs network packets to a disk for later analysis.

---

Installation Steps

1. Install Winpcap

   • Download and install Winpcap, a library required for SNORT to capture network packets.

2. Verify Winpcap Installation

   • Open the Add or Remove Programs section in Windows to ensure Winpcap is installed successfully.

3. Install SNORT

   • Download and install SNORT in the
     Copy

     C:\

     folder (recommended for easier setup).

4. Add SNORT to Defender Exclusion List

   • Add the SNORT folder (
     Copy

     C:\Snort

     ) to the Windows Defender exclusion list to prevent interference.

5. Ensure 7-Zip is Installed

   • Install 7-Zip, which will be used to extract rule files.

6. Extract Rule Files

   • Navigate to the folder containing
     Copy

     snortrules-snapshot-2923.tar.gz

     .
     • Right-click and choose
       Copy

       7-Zip > Extract Here

       .
     • If the
       Copy

       7-Zip

       option isn’t visible, select More Options after right-clicking.
   • After extraction, right-click the
     Copy

     .tar

     file and choose
     Copy

     7-Zip > Extract Files

     .
     • Set
       Copy

       C:\Snort

       as the destination folder.
     • In the options, select Overwrite without prompt and uncheck any checkboxes.

7. Open Command Prompt and Configure SNORT

   • Open Command Prompt as an administrator and navigate to
     Copy

     C:\Snort\bin

     :

   shellCopy
   	cd C:\Snort\bin
   

8. Verify SNORT Installation

   • Run the following command to list available network interfaces, confirming SNORT is installed correctly.

   shellCopy
   	snort -W
   

Address any errors shown during the setup and apply the extra changes suggested in the error logs. The steps to resolve those errors are given below.

---

Key Commands and Usage

Running SNORT

• Always run SNORT as an administrator. (Run

  Copy

  cmd

  as administrator and navigate to the
  Copy

  C:\Snort\bin

  ) then start using the
  Copy

  snort

  commands:

• Default SNORT executable path:

  plaintextCopy
  C:\Snort\bin\snort.exe
  

List Network Interfaces

• Use the following command to list interfaces supported by SNORT:

  shellCopy
  snort -W
  

• Use this along with:

  shellCopy
  getmac /fo csv /v
  

  This retrieves MAC addresses of network adapters, helping identify the correct interface.

Capture Packets

• To select a specific interface (e.g., interface 4):

  shellCopy
  snort -i 4
  

• Stop packet capturing:

  • Press
    Copy

    CTRL + C

    .

Additional Flags

• To see application layer data:

  shellCopy
  snort -i 4 -d
  

• To see data link layer data:

  shellCopy
  snort -i 4 -e
  

• For verbose output:

  shellCopy
  snort -i 4 -v
  

---

Rules in SNORT

• SNORT uses rules to detect known threats, similar to how antivirus software uses signature files.
• Initially, the rules folder is empty.
• You can:
  • Download pre-defined rule files from SNORT developers.
  • Create custom rule files tailored to specific needs.

Important Note

• Add SNORT rule files to the Windows Defender exclusion list to avoid interference.

Copy

browser-ie.rules

File

• This file contains rules related to Internet Explorer vulnerabilities. This file is automatically deleted if you do not add the
  Copy

  Snort

  folder to the exclusion list of Windows Defender.

---