How I Detected a Network Attack Using Snort (Step-by-Step)

Before any cyber attack actually happens, there is usually a silent phase called reconnaissance.

This is where an attacker tries to gather as much information as possible about the target system such as open ports, running services, and potential vulnerabilities. Even though it looks harmless, this phase is very important because it determines how the next attack will be executed.

In this project, a network security simulation was conducted to understand how reconnaissance attacks work and how they can be detected using Snort. The experiment began by setting up a controlled lab environment using two virtual machines. One machine, running Kali Linux, was configured as the attacker, while another machine running Ubuntu was used as the target system and equipped with Snort for traffic monitoring. Both systems were connected within the same virtual network to ensure proper communication while maintaining isolation from external networks.

After completing the network setup, the configuration was verified using the ifconfig command to confirm that both machines had valid IP addresses within the same subnet. Once verified, Snort was first tested using validation mode to ensure that its configuration file and rules were properly loaded. This step is crucial because Snort relies entirely on its rule set to detect suspicious activities, meaning that any misconfiguration could result in failure to detect attacks. After successful validation, Snort was executed in real-time monitoring mode, allowing it to continuously observe and analyze network traffic passing through the selected interface.

With the detection system running, reconnaissance attacks were simulated from the attacker machine using Nmap and Legion. These tools were used to scan the target system in order to identify open ports and running services, which is a common technique used by attackers during the information gathering phase. The scanning process successfully revealed several open ports on the target machine, confirming that the reconnaissance activity was functioning as expected. At the same time, Snort actively monitored the incoming traffic and generated multiple alerts, indicating detection of suspicious behaviors such as scanning attempts, abnormal traffic patterns, and information gathering activities. These alerts demonstrate how network intrusion detection systems can identify early-stage attacks by analyzing traffic patterns and matching them against predefined rules.

Going back to the project, in this project, I tried to simulate this exact scenario:

1. Perform reconnaissance attacks

2. 2. Monitor the traffic

3. Detect it in real-time

And for that, I used a well-known intrusion detection system: Snort

What is Snort?

Snort is an open-source Network Intrusion Detection System (IDS) that monitors network traffic and analyzes it using predefined rules.

In simple terms:

• It listens to network traffic
• Compares it with rules
• Alerts you if something suspicious happens

Unlike an IPS (Intrusion Prevention System), Snort in this setup does not block attacks, but it helps us detect them early, which is just as important.

Lab Setup

To simulate a real-world environment, I used two virtual machines:

• Kali Linux → Attacker
• Ubuntu → Target + Snort (Detection System)

Both machines are connected through a virtual network using VirtualBox, allowing them to communicate with each other.

Network Configuration:

• Attacker IP: 10.0.2.4
• Target IP: 10.0.2.15

This setup creates a controlled environment where attacks can be tested safely without affecting real systems.

Running Snort

Before starting detection, I first validated the configuration using this command:

sudo snort -T -c /etc/snort/snort.conf -i enp0s3

What does this mean?

• -T → Test configuration
• -c → Configuration file
• -i enp0s3 → Network interface

and enp0s3 is the network interface used by the system to communicate with the network.

This step is very important because:

If Snort configuration is wrong then it won’t detect anything

Running Snort in Monitoring Mode

After validation, I ran Snort using:

sudo snort -A console -q -u snort -g snort -c /etc/snort/snort.conf -i enp0s3

This command:

• Displays alerts in real-time
• Monitors network traffic
• Uses predefined rules to detect attacks

At this point, Snort is actively listening to everything happening in the network.

Running Snort in Monitoring Mode

After validation, I ran Snort using:

sudo snort -A console -q -u snort -g snort -c /etc/snort/snort.conf -i enp0s3

This command:

• Displays alerts in real-time
• Monitors network traffic
• Uses predefined rules to detect attacks

At this point, Snort is actively listening to everything happening in the network.

Simulating the Attack

To simulate reconnaissance, I used:

• Nmap (command-line based)
• Legion (GUI-based tool)

Using Nmap

Nmap is used to scan open ports and services.

Example:

• It checks which ports are open
• Identifies services like SSH, FTP, etc.

This is a classic reconnaissance technique.

Using Legion (GUI Tool)

Legion makes things easier by:

• Providing a graphical interface
• Automating scans
• Running Nmap in the background

You just:

• Input the target IP
• Choose scan options
• Click start

Detection Results

Once the scan started, something interesting happened…

From the attacker side:

• Open ports discovered:
• FTP (21)
• SSH (22)
• Telnet (23)

This confirms that reconnaissance was successful.

From Snort (Detection side):

Snort immediately started generating alerts like:

• Nmap XMAS Scan detected
• SNMP request activity
• Attempted Information Leak
• Suspicious traffic patterns

These alerts indicate:

The system is being probed and analyzed by an attacker.

What does “Attempted Information Leak” mean?

It means:

• The attacker is trying to extract information
• Not yet exploiting, but preparing

What I Learned

This project helped me understand that:

• Detection depends heavily on rules
• No rules = no detection
• Even simple scans can trigger alerts
• Real-time monitoring is crucial

Also, I realized that cyber attacks don’t start with hacking but they start with information gathering

Why This Matters in Real Life

In real-world environments:

• Systems have multiple services
• Different network zones (DMZ, internal, etc.)
• Various types of traffic

Because of that:

• Rules must be customized
• Monitoring must be continuous

Snort can be very powerful, but only if configured properly.

In this project, I successfully simulated reconnaissance attacks and detected them using Snort within a controlled environment. By performing network scanning using tools such as Nmap and Legion, the system was able to generate real-time alerts that indicate suspicious activities, particularly those related to information gathering and port scanning. These results demonstrate that Snort is capable of effectively identifying early-stage attacks, allowing security analysts to become aware of potential threats before they escalate into more serious incidents.

However, the effectiveness of Snort heavily depends on several important factors, including proper configuration, the use of updated and relevant rules, and correct deployment within the network environment. Without well-defined rules, Snort would not be able to accurately classify or detect malicious traffic. Overall, this project highlights the importance of intrusion detection systems in modern cybersecurity, showing that early detection plays a crucial role in defending systems against potential attacks and maintaining overall network security.