{"id":432,"date":"2024-11-26T22:24:36","date_gmt":"2024-11-26T22:24:36","guid":{"rendered":"https:\/\/sites.wp.odu.edu\/cmayo\/?p=432"},"modified":"2024-11-26T22:24:36","modified_gmt":"2024-11-26T22:24:36","slug":"snort-practice-using-open-source-intrusion-prevention-system-ips","status":"publish","type":"post","link":"https:\/\/sites.wp.odu.edu\/cmayo\/2024\/11\/26\/snort-practice-using-open-source-intrusion-prevention-system-ips\/","title":{"rendered":"SNORT: Practice Using Open-Source Intrusion Prevention System (IPS)"},"content":{"rendered":"\n

Using Snort was a great way to practice real world skills in network monitoring and automating alerts with an IPS.<\/p>\n\n\n\n

Snort is a widely used open-source Intrusion Prevention System (IPS) that can use both custom set rules and community-set rules to find and analyze malicious traffic. Snort can be used as a packet sniffer, packet logger, and be a line of defense against network attacks. In this project, I will show how to download and install this free resource, as well as how to monitor and set rules for catching network traffic.<\/p>\n\n\n\n

First, I recommend getting your snort account setup at www.snort.org<\/a> so you can purchase the free product and be able to use.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Step 2.\u00a0 Download and run the Snort 2.9.20.exe to install snort on your end device.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Next, after successful download, Snort requires you to download npcap for packet captures dependency.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Make sure to download the correct version for your OS. I am running on Windows 10, so I downloaded the windows 10 version (x64)<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Next download the community rules from the snort website, then extract them to your snort \/rules folder.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Next, open up the Snort.conf file to configure the rules for the IPS to capture traffic.<\/p>\n\n\n\n

Including the host IP address, the blacklist and whitelist.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Make sure to configure the Firewall rules as well , I put them in the Snort\\Rules folder.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Now I am going to show you how to run snort and start analyzing traffic.\u00a0 First, open your command line as an Admin, and run cd C:\\snort\\bin<\/strong> to change directories to where snort is located on your host drive.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

After that, use the snort \u2013W command to verify the interfaces snort is running on. For this demonstration I will run on interface 5 as I configured it on the config file.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Lastly, run snort \u2013i 4 c:\/Snort\/rules\/bin\/snort.conf -A to start monitoring the network traffic based on the config file.<\/p>\n\n\n\n

***IT should look something like this, however mine is having issues as I keep getting the same error.<\/p>\n\n\n\n

\"\"<\/figure>\n","protected":false},"excerpt":{"rendered":"

Using Snort was a great way to practice real world skills in network monitoring and automating alerts with an IPS. Snort is a widely used open-source Intrusion Prevention System (IPS) that can use both custom set rules and community-set rules to find and analyze malicious traffic. Snort can be used as a packet sniffer, packet… <\/p>\n

Read More<\/a><\/div>\n","protected":false},"author":21758,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":"","wds_primary_category":0},"categories":[1],"tags":[],"_links":{"self":[{"href":"https:\/\/sites.wp.odu.edu\/cmayo\/wp-json\/wp\/v2\/posts\/432"}],"collection":[{"href":"https:\/\/sites.wp.odu.edu\/cmayo\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/sites.wp.odu.edu\/cmayo\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/sites.wp.odu.edu\/cmayo\/wp-json\/wp\/v2\/users\/21758"}],"replies":[{"embeddable":true,"href":"https:\/\/sites.wp.odu.edu\/cmayo\/wp-json\/wp\/v2\/comments?post=432"}],"version-history":[{"count":1,"href":"https:\/\/sites.wp.odu.edu\/cmayo\/wp-json\/wp\/v2\/posts\/432\/revisions"}],"predecessor-version":[{"id":443,"href":"https:\/\/sites.wp.odu.edu\/cmayo\/wp-json\/wp\/v2\/posts\/432\/revisions\/443"}],"wp:attachment":[{"href":"https:\/\/sites.wp.odu.edu\/cmayo\/wp-json\/wp\/v2\/media?parent=432"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/sites.wp.odu.edu\/cmayo\/wp-json\/wp\/v2\/categories?post=432"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/sites.wp.odu.edu\/cmayo\/wp-json\/wp\/v2\/tags?post=432"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}