Snort: An Open-Source Network Intrusion Detection System
Snort
Ahmed El Shafie and Mohammad Ali
What is Snort?
●
Open source network intrusion detection system (NIDS) created by
Cisco
●
Analyzes network packets to detect suspicious input and/or behaviour
●
Snort can be used as a straight packet sniffer like tcpdump, a packet
logger (useful for network traffic debugging), or as a full-blown
network intrusion prevention system
How does it work?
●
Monitors incoming packets on a specific host or
even your entire network.
●
Set of rules that are pattern matched with observed
network activity
●
Can be placed outside your firewall for more
external traffic to analyze, or inside firewall for
internal traffic or on router using Openwrt
Where can snort be installed?
●
Snort can be installed anywhere inside your network ,outside your
network along with a firewall, or installed on your firewall (openwrt)
●
Snort can watch for traffic between your servers inside the network
i.e sniff traffic between SQL server and Web server.
●
Snort can also work in conjunction with a firewall. The firewall filters
out unimportant traffic i.e: from other countries. Snort does further
packet analysis using stateful rules.
Snort vs Wireshark
●
Very similar except Wireshark requires more
manual inspection, even after filtering
●
Snort relies more on preset rules that trigger
automatically
●
Snort has IDS/IPS mode which allows for more
complex packet filtering/analysis
Snort modes
Snort can be runned in 4 modes:
●
Sniffer mode
: snort will read the network traffic and print them to the
screen.
●
Packet logger mode
: snort will record the network traffic on a file
●
IDS mode
: network traffic matching security rules will be recorded.
●
IPS mode
: also known as snort-inline (IPS = Intrusion prevention
system)
Sniffer Mode
●
./snort
○
-v for printing out the IP packet info to the
console
○
-d for printing the application layer payload in
bytes
○
-e to print the link layer header as well
Packet Logger Mode
●
Like sniffer mode but logs packets to a specified
directory.
●
Use -l flag, then specify existing file path on disk,
otherwise error
●
./snort d -l ~/logfile
Demo
Intrusion Detection System (IDS) Mode
●
Use a file that contains rules which are used to
analyze packets
●
When running snort, packets that match rules will
have actions described in rules taken
●
Can have multiple rules in file
●
All rule conditions must be satisfied for rule to be
triggered
Basic Rule Syntax - Overview
●
T
h
e
r
u
l
e
h
e
a
d
e
r
c
o
n
t
a
i
n
s
t
h
e
r
u
l
e
'
s
a
c
t
i
o
n
,
p
r
o
t
o
c
o
l
,
s
o
u
r
c
e
a
n
d
d
e
s
t
i
n
a
t
i
o
n
I
P
a
d
d
r
e
s
s
e
s
a
n
d
n
e
t
m
a
s
k
s
,
a
n
d
t
h
e
s
o
u
r
c
e
a
n
d
d
e
s
t
i
n
a
t
i
o
n
p
o
r
t
s
i
n
f
o
r
m
a
t
i
o
n
●
A
c
t
i
o
n
t
o
t
a
k
e
(
o
p
t
i
o
n
)
T
h
e
f
i
r
s
t
i
t
e
m
i
n
a
r
u
l
e
i
s
t
h
e
r
u
l
e
a
c
t
i
o
n
.
T
h
e
r
u
l
e
a
c
t
i
o
n
t
e
l
l
s
S
n
o
r
t
w
h
a
t
t
o
d
o
w
h
e
n
i
t
f
i
n
d
s
a
p
a
c
k
e
t
t
h
a
t
m
a
t
c
h
e
s
t
h
e
r
u
l
e
c
r
i
t
e
r
i
a
(
u
s
u
a
l
l
y
a
l
e
r
t
)
.
●
T
h
e
n
e
x
t
f
i
e
l
d
i
n
a
r
u
l
e
i
s
t
h
e
p
r
o
t
o
c
o
l
.
T
h
e
r
e
a
r
e
f
o
u
r
p
r
o
t
o
c
o
l
s
t
h
a
t
S
n
o
r
t
c
u
r
r
e
n
t
l
y
a
n
a
l
y
z
e
s
f
o
r
s
u
s
p
i
c
i
o
u
s
b
e
h
a
v
i
o
r
-
T
C
P
,
U
D
P
,
I
C
M
P
,
a
n
d
I
P
Actions
●
a
l
e
r
t
-
o
u
t
p
u
t
a
w
a
r
n
i
n
g
a
n
d
i
n
f
o
o
n
c
o
n
s
o
l
e
a
b
o
u
t
s
u
s
p
i
c
i
o
u
s
p
a
c
k
e
t
●
l
o
g
-
l
o
g
t
h
e
p
a
c
k
e
t
(
l
o
g
~
/
l
o
g
f
i
l
e
)
●
p
a
s
s
-
d
o
n
o
t
h
i
n
g
●
d
r
o
p
-
d
r
o
p
t
h
e
p
a
c
k
e
t
b
u
t
l
o
g
i
t
i
n
l
o
g
f
i
l
e
●
s
d
r
o
p
-
d
r
o
p
b
u
t
d
o
n
’
t
l
o
g
●
r
e
j
e
c
t
-
d
r
o
p
,
l
o
g
,
a
n
d
t
e
r
m
i
n
a
t
e
o
r
d
e
c
l
i
n
e
c
o
n
n
e
c
t
i
o
n
Rule Options
●
msg - “msg”: The message printed to console when rule is triggered
●
content: “String” - Search for specific string in packet payload
●
detection_filter: track <by_src|by_dst>, count <c>, seconds <s>;
○
If source ip address is a network instead of a single host, track
by_src triggers when number of packets sent by a single host in
network exceeds <c> in <s> seconds
○
Similar for track by_dst
●
flags:
flag
- Checks for certain bits that are set on TCP packet
●
E.g S = SYN bit, A = ACK bit, F = FIN bit
Stateful Rules
●
Rules that rely on previously obtained information
●
For example:
○
detection_filter relies on previous triggers of the rule
○
flow: Can be used to detect the state of a TCP connection when
packet is received from host
○
flow: established.
Rule will trigger only if TCP connection
established with sender is established when packet is received
IPS/Inline Mode
●
Unless this mode is enabled, Snort won’t drop
packets, it will only warn (IDS)
●
To enable:
○
snort -Q
○
config policy_mode:inline
●
Can act like a second firewall, dropping packets that
trigger rules
Basic Rule
●
alert icmp any any -> $HOME_NET any (msg:
“ICMP packet detected”)
●
Alert if ICMP packet received from any source ip
and port to home network on any port and output
“ICMP packet detected”
Attack Detection
●
Rules for malicious activity
●
Example - SYN Flood - Stateful Rule:
○
alert tcp any any -> $HOME_NET 80 (flags: S; msg:"Possible
TCP DoS"; flow: stateless; detection_filter: track by_dst, count
70, seconds 10;)
●
If a host on home network receives more than 70
SYN requests in 10 seconds, start alerting
Attack Detection - Cont.
The following rule will alert in case of a ping of flood attack:
alert icmp any any -> 127.0.0.1 any (msg:"Ping of Death Detected"; dsize:>1000; itype:8; icode:0;
detection_filter:track by_src, count 5, seconds 10; sid:2000004; classtype:denial-of-service; rev:1;)
●
Dsize: size of data
●
Detection_filter track by_src: count based on source address
●
Seconds: sampling period
●
Count: number of packets that should match rule during sampling period before alerting
●
Classtype: classifies the attack. (helpful for sysadmin to know what is happening)
●
Itype and icode: specifying type of ICMP packet
Demo
Rule Subscription
●
https://www.snort.org/products#rule_subscriptions
●
Subscribing allows you to access new rules immediately, 30 days sooner than
non-subscribers
●
Allows you to contribute to Snort by submitting false positive/negative reports
●
Personal Subscription: $30/yr/person. For use in home network or personal
education
●
Business Subscription: $400/yr/sensor. For use in businesses, universities,
etc.
●
https://github.com/eldondev/Snort/tree/master/rules
contains free basic rules
for all kinds of attacks
Strengths
●
Open Source
●
Rules help to automate defenses
●
Rules aren’t too verbose
●
Can make custom rules
●
A lot of rules posted by community
Weaknesses
●
Dropping packets, instead of alerting, is risky
because of false positives. Therefore, alerting
followed by manual inspection is generally the best
●
Being open source, attackers can look at code and
learn to bypass some of Snort’s built-in rules
Snort is an open-source Network Intrusion Detection System (NIDS) developed by Cisco, capable of analyzing network packets to identify suspicious activities. It can function as a packet sniffer, packet logger, or a full-fledged intrusion prevention system. By monitoring and matching network activity with predefined rules, Snort enhances network security by detecting potential threats both internally and externally. Its versatility allows installation in various network locations and integration with firewalls for comprehensive protection.
Download Presentation
Please find below an Image/Link to download the presentation.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author. Download presentation by click this link. If you encounter any issues during the download, it is possible that the publisher has removed the file from their server.
E N D
Presentation Transcript
Snort Ahmed El Shafie and Mohammad Ali
What is Snort? Open source network intrusion detection system (NIDS) created by Cisco Analyzes network packets to detect suspicious input and/or behaviour Snort can be used as a straight packet sniffer like tcpdump, a packet logger (useful for network traffic debugging), or as a full-blown network intrusion prevention system
How does it work? Monitors incoming packets on a specific host or even your entire network. Set of rules that are pattern matched with observed network activity Can be placed outside your firewall for more external traffic to analyze, or inside firewall for internal traffic or on router using Openwrt
Where can snort be installed? Snort can be installed anywhere inside your network ,outside your network along with a firewall, or installed on your firewall (openwrt) Snort can watch for traffic between your servers inside the network i.e sniff traffic between SQL server and Web server. Snort can also work in conjunction with a firewall. The firewall filters out unimportant traffic i.e: from other countries. Snort does further packet analysis using stateful rules.
Snort vs Wireshark Very similar except Wireshark requires more manual inspection, even after filtering Snort relies more on preset rules that trigger automatically Snort has IDS/IPS mode which allows for more complex packet filtering/analysis
Snort modes Snort can be runned in 4 modes: Sniffer mode: snort will read the network traffic and print them to the screen. Packet logger mode: snort will record the network traffic on a file IDS mode: network traffic matching security rules will be recorded. IPS mode: also known as snort-inline (IPS = Intrusion prevention system)
Sniffer Mode ./snort -v for printing out the IP packet info to the console -d for printing the application layer payload in bytes -e to print the link layer header as well
Packet Logger Mode Like sniffer mode but logs packets to a specified directory. Use -l flag, then specify existing file path on disk, otherwise error ./snort d -l ~/logfile
Intrusion Detection System (IDS) Mode Use a file that contains rules which are used to analyze packets When running snort, packets that match rules will have actions described in rules taken Can have multiple rules in file All rule conditions must be satisfied for rule to be triggered
Basic Rule Syntax - Overview The rule header contains the rule's action, protocol, source and destination IP addresses and netmasks, and the source and destination ports information Action to take (option) The first item in a rule is the rule action. The rule action tells Snort what to do when it finds a packet that matches the rule criteria (usually alert). The next field in a rule is the protocol. There are four protocols that Snort currently analyzes for suspicious behavior - TCP, UDP, ICMP, and IP
Actions alert - output a warning and info on console about suspicious packet log - log the packet (log ~/logfile) pass - do nothing drop - drop the packet but log it in logfile sdrop - drop but don t log reject - drop, log, and terminate or decline connection
Rule Options msg - msg : The message printed to console when rule is triggered content: String - Search for specific string in packet payload detection_filter: track <by_src|by_dst>, count <c>, seconds <s>; If source ip address is a network instead of a single host, track by_src triggers when number of packets sent by a single host in network exceeds <c> in <s> seconds Similar for track by_dst flags: flag - Checks for certain bits that are set on TCP packet E.g S = SYN bit, A = ACK bit, F = FIN bit
Stateful Rules Rules that rely on previously obtained information For example: detection_filter relies on previous triggers of the rule flow: Can be used to detect the state of a TCP connection when packet is received from host flow: established. Rule will trigger only if TCP connection established with sender is established when packet is received
IPS/Inline Mode Unless this mode is enabled, Snort won t drop packets, it will only warn (IDS) To enable: snort -Q config policy_mode:inline Can act like a second firewall, dropping packets that trigger rules
Basic Rule alert icmp any any -> $HOME_NET any (msg: ICMP packet detected ) Alert if ICMP packet received from any source ip and port to home network on any port and output ICMP packet detected
Attack Detection Rules for malicious activity Example - SYN Flood - Stateful Rule: alert tcp any any -> $HOME_NET 80 (flags: S; msg:"Possible TCP DoS"; flow: stateless; detection_filter: track by_dst, count 70, seconds 10;) If a host on home network receives more than 70 SYN requests in 10 seconds, start alerting
Attack Detection - Cont. The following rule will alert in case of a ping of flood attack: alert icmp any any -> 127.0.0.1 any (msg:"Ping of Death Detected"; dsize:>1000; itype:8; icode:0; detection_filter:track by_src, count 5, seconds 10; sid:2000004; classtype:denial-of-service; rev:1;) Dsize: size of data Detection_filter track by_src: count based on source address Seconds: sampling period Count: number of packets that should match rule during sampling period before alerting Classtype: classifies the attack. (helpful for sysadmin to know what is happening) Itype and icode: specifying type of ICMP packet
Rule Subscription https://www.snort.org/products#rule_subscriptions Subscribing allows you to access new rules immediately, 30 days sooner than non-subscribers Allows you to contribute to Snort by submitting false positive/negative reports Personal Subscription: $30/yr/person. For use in home network or personal education Business Subscription: $400/yr/sensor. For use in businesses, universities, etc. https://github.com/eldondev/Snort/tree/master/rules contains free basic rules for all kinds of attacks
Strengths Open Source Rules help to automate defenses Rules aren t too verbose Can make custom rules A lot of rules posted by community
Weaknesses Dropping packets, instead of alerting, is risky because of false positives. Therefore, alerting followed by manual inspection is generally the best Being open source, attackers can look at code and learn to bypass some of Snort s built-in rules
