SNORT - Network IDS & IPS

Snort is an open-source & rule-based network intrusion detection system & intrusion prevention system (NIDS & NIPS).

Network Intrustion Detection System (NIDS)

• NIDS is an active monitoring solution which detects possible malicious activities/patterns, abnormal incidents, and policy violations.
• This solution is resonsible for generating alerts for each suspicious event.
• NIDS monitors traffic flow from various area of networks.
• The aim of NIDS is to investigate the traffic on entire subnet.
• If signature is identified, alerts are generated accordingly.

Network Intrusion Prevention System (NIPS)

• NIPS monitors the traffic flow from various area of the network.
• The aim is to protect (prevent) the traffic on the entire subnet.
• If signature is identified, connections are terminated accordingly.

Detection & Prevention Techniques

1. Signature-Based

• Relies on rules that identify the specific patterns of the known malicious behavior.
• Detects known threats.

2. Behaviour-Based

• Identifies new threats with new patterns that passes through signatures.
• Compares the known/normal with unknown/abnormal behaviours. \
• Detects previously unknown or new threats.

3. Policy-Based

• Compares detected activities with system configuration & security policies.
• Detect policy violations.

Capabilities of SNORT

• Live traffic analysis.
• Attack and probe detection.
• Packet logging.
• Protocol analysis.
• Real-time alerting.
• Modules & plugins.
• Pre-processors.
• Cross-platform support (Windows & Linux).

Use Modes of SNORT

1. Sniffer Mode

• Reads IP packets and prompts them in the console application.

2. Packet Logger Mode

• Logs all IP packets (inbound & outbound) that travels through the network.

3. NIDS/NIPS

• Logs/drops the packets that are deemed as malicious according to the user-defined and default rules.

SNORT Rule Structure

Action Protocol Source_IP Source_Port <-> Destination_IP Destination_Port

Eg:- Rule to detect all TCP packets from-or-to port 80.

alert tcp any 80 <> any any (msg: “Inbound-Port 80”; sid: 10001; rev: 1)

alert tcp any any <> any 80 (msg: “Outbound-Port 80”; sid: 10002; rev: 1)