Snort for Network IDS

What is Snort?

Snort is an open source network intrusion detection system (NIDS) that can audit network traffic in real-time. Snort is a packet sniffer, a packet logger, and a network intrusion detection system.

Snort as I mentioned before is an open source software which means it can be configured and complied on most operating systems. Snort has been ported over to Microsoft Windows operating systems also, but it's bread and butter is back on the UNIX/Linux side of the house. Most Linux distributions now include Snort as part of their install package, and though it may not be enabled by default, normally it is on the installation CD's or DVD's.

Should I run Snort if I have a firewall?

I believe that yes you should run a NDIS even with a firewall. Firewalls help to block packets coming in to your system, however if you are running different servers or services that require the firewall to let them through you are letting a large amount of data go un-audited. Snort has the ability to see trends in incoming data and identify them as a threat and take appropriate action on your system. Snort gives you the ability to see if you are being port scanned, or to see if someone is trying to abuse well known backdoors or problems in well known daemons. Running services and applications that help you to protect your system is always a good idea. Many system administrators run a firewall, snort, and a data file integrity checker (often Tripwire).

How does snort actually work?

Snort generally is running as a background application and it is constantly packet sniffing all the information passing through your network interface card (NIC). The data is then sorted by various preprocessors that basically sort the packet data in to different categories. Once the data has been sorted out it is run through the rules, or the detection phase. As Snort detects trends in the data it applies the rules and actions them appropriately. The final stages are logging the rule infractions and if configured alerting the system administration team in real-time as the infraction occurs.

Is Snort difficult to configure and use?

Snort, as mentioned before now often comes bundled or available through rpm's in most Linux distributions. The hard part of running snort is if you decide to create your own original rules which can get extremely complex. However, luckily for us you can download up to date rule sets for free off the Snort website (you must signup for the free registration).

For extra ease of use there are many different applications and log parsers which have been designed to work with Snort. These applications can create websites based on the data Snort has logged or help you identify trends or possibly security threats on your system.

Ken Dennis
http://KenDennis-RSS.homeip.net/

---

Review of TikiWiki Content Management System

TikiWiki is open source software - it is written in... Read More

Who?s Watching What You Type?

If someone entered your home, uninvited and installed numerous cameras... Read More

IT Strategy for Large Corporation: ERP/MRP/CRM, Unix/Linux/Windows, Microsoft/Java

Combining Microsoft Business Solutions Great Plains ERP with non-Microsoft Business... Read More

When is a Software Engineer Not a Software Engineer?

The title of "software engineer" has got to be among... Read More

Protect Your Most Vital Business Asset with Security Software

Homeland security, airport security, Internet security â?" these days weâ??re... Read More

My Experience - Making a Vision into Reality

Disclaimer: All the thoughts expressed are my views only! Your... Read More

EDI: Electronic Document Interchange for Microsoft Great Plains ? Overview for Software Developer/Pr

Microsoft Great Plains - Microsoft Business Solutions accounting and ERP... Read More

10 Programming Tips

(1) Avoid using the same variable again and again for... Read More

Quick Summary of Basic and Common Linux Commands

There are many commands that are used in linux on... Read More

Microsoft CRM: Data Conversion ? Import from Act!

Best Software Act! is very popular CRM for small and... Read More

Adware, What Is It?

Adware is a type of Spyware program that displays some... Read More

Microsoft CRM Conversation Gateway: VoIP - Implementation & Customization

Microsoft CRM is winning market share step-by-step from such the... Read More

Groove Network. Are you in it?

If you are in a business that passes documents around... Read More

Microsoft Great Plains - Typical Problems And Fixes ? Overview For IT Administrators

How to delete the user? This is the first problem... Read More

Microsoft Great Plains RW: Report Writer

Microsoft Business Solutions Great Plains is marketed for mid-size companies... Read More

Unwanted Files

A LOT OF UNWANTED FILES.When you uninstall an item of... Read More

What You Must Know About Spyware Right Now

Spyware is like the new technological nuclear weapon on the... Read More

Instant Messenger Clients

If you have been using the Internet for any amount... Read More

The Truth: Netzero 3G

We've all seen the ads on TV for Netzero 3G.... Read More

Recovering Microsoft Great Plains Customization ? Tips for IT Director

Remember nice and prosperous Clinton era? When you implemented innovative... Read More

Need of Document Management System (DMS)

Document Management or Enterprise Information Management is perhaps one of... Read More

eStore Advantage ? Extending Microsoft eConnect for MBS Great Plains

eStore Advantage allows front-office applications to communicate with back-office business... Read More

Explore the Internet in a Whole New Way

For a long time now Microsoft's Internet Explorer has ruled... Read More

Software Upgrades Arent Always the Best Move

When my daughter was getting into AOL instant messaging (AIM)... Read More

How To Create A Data Capture Procedure Checklist For Your Small Business CRM Software

Fortunately one of the most common reasons cited for the... Read More

Computer Based Language Development and Spell-checking

Language development computer: Computer-based method for aiding language development seems... Read More

Is Your Family Protected?

When you think... Read More

Tools for Customizing Great Plains

Microsoft Business Solutions ? Great Plains has captured the US... Read More

Does Microsoft have any real competition?

Does Microsoft Have any Real Competition? Copyright (c) 2003 Gregory... Read More

Reporting Tools for Microsoft Great Plains ? Overview For Developers

Looks like Microsoft Great Plains becomes more and more popular,... Read More

Hubris - Definition: Microsofts Passport

Before September of 1995, Microsoft ignored the Internet because their... Read More

A Case Study on Selecting Contract Management Software

Professional services firm cuts costs and improves productivity with integrated... Read More

The Bluebird Project

The objective for Zandi Digital is to make available clever... Read More