Snort for Network IDS

What is Snort?

Snort is an open source network intrusion detection system (NIDS) that can audit network traffic in real-time. Snort is a packet sniffer, a packet logger, and a network intrusion detection system.

Snort as I mentioned before is an open source software which means it can be configured and complied on most operating systems. Snort has been ported over to Microsoft Windows operating systems also, but it's bread and butter is back on the UNIX/Linux side of the house. Most Linux distributions now include Snort as part of their install package, and though it may not be enabled by default, normally it is on the installation CD's or DVD's.

Should I run Snort if I have a firewall?

I believe that yes you should run a NDIS even with a firewall. Firewalls help to block packets coming in to your system, however if you are running different servers or services that require the firewall to let them through you are letting a large amount of data go un-audited. Snort has the ability to see trends in incoming data and identify them as a threat and take appropriate action on your system. Snort gives you the ability to see if you are being port scanned, or to see if someone is trying to abuse well known backdoors or problems in well known daemons. Running services and applications that help you to protect your system is always a good idea. Many system administrators run a firewall, snort, and a data file integrity checker (often Tripwire).

How does snort actually work?

Snort generally is running as a background application and it is constantly packet sniffing all the information passing through your network interface card (NIC). The data is then sorted by various preprocessors that basically sort the packet data in to different categories. Once the data has been sorted out it is run through the rules, or the detection phase. As Snort detects trends in the data it applies the rules and actions them appropriately. The final stages are logging the rule infractions and if configured alerting the system administration team in real-time as the infraction occurs.

Is Snort difficult to configure and use?

Snort, as mentioned before now often comes bundled or available through rpm's in most Linux distributions. The hard part of running snort is if you decide to create your own original rules which can get extremely complex. However, luckily for us you can download up to date rule sets for free off the Snort website (you must signup for the free registration).

For extra ease of use there are many different applications and log parsers which have been designed to work with Snort. These applications can create websites based on the data Snort has logged or help you identify trends or possibly security threats on your system.

Ken Dennis
http://KenDennis-RSS.homeip.net/

---

Information Products: A Business Owners Best Friend

We live in a post-industrial age where information is the... Read More

What is Fleet Maintenance Software?

Simply put, fleet maintenance allows companies to monitor and maintain... Read More

Review on QuarkXpress 6.0

After almost two decades of existence, Quark has become the... Read More

SQL: Querying Microsoft Great Plains ? Overview for Database Administrator/Developer

Looks like Microsoft Great Plains becomes more... Read More

String in Java

Handling character strings in Java is supported through two final... Read More

Groupware Finds Home in American Business: Collaboration Tool Analysis

What is Groupware?Have you ever had to manage document collaboration... Read More

Getting Technical Support Help Online

Sometimes your PC will start acting strange for no apparent... Read More

Microsoft CRM Integration & Customization: SharePoint Document Gateway

MS CRM is very close to document workflow automation, including... Read More

Free Microsoft Word Online Training Tutorial Resources

Microsoft Word is one of the most popular office applications... Read More

HelpDesk & Asset Management Software - Choosing The Right One

If you are to buy a HelpDesk & Asset Management... Read More

Photoshop Files and Formats

People often ask me: What image file formats will Photoshop... Read More

Antivirus Software ? Get The Bugs Before They Get You!

You turn on your computer, and it doesn't look quite... Read More

IT Strategy for Large Corporation: ERP/MRP/CRM, Unix/Linux/Windows, Microsoft/Java

Combining Microsoft Business Solutions Great Plains ERP with non-Microsoft Business... Read More

Benefits of Integrating Online Chat Software with CRM

Customer Relationship Management (CRM) is a strategy and processes used... Read More

Database Guru James F. Koopmann Reviews DBxtra Reporting and Query Tool

DBxtra is a powerful query and reporting tool that hides... Read More

Screenplay and Script Writing Software

When it comes to screenplay software each screenwriter needs to... Read More

Microsoft Great Plains - Payroll & HR Inexpensive Solution? Not Any More

Microsoft Great Plains is main Microsoft Business Solutions accounting package... Read More

Algebra Help Software

Need help making sense of algebra? Have algebra lectures in... Read More

20 Extra Hours Per Week: What Would You Do?

While I was in college, if you would have asked... Read More

Microsoft Great Plains Implementation & Customization: Computer Parts Retailer Example

Microsoft Great Plains fits to majority of horizontals and retail... Read More

Basic Steps To Optimize Your Internet Security

After seeing many people complain about their weak Internet security... Read More

The Hidden Power of Online Manual

Writing software manuals is boring, isn't it? We often think:... Read More

Microsoft Business Solutions - Navision Customization: C/SIDE, C/ODBC, C/FRONT, XBRL

Microsoft bought Navision, Denmark based software development company, along with... Read More

10 Things You Can Do With Photoshop CS2 That You Couldnt Do Before Now

Is Photoshop CS2 worth the upgrade? You bet it is!... Read More

Best Spyware Removers

Finding the best spyware removers to detect and remove spyware... Read More

Chinese Input - Step by Step Instruction on How to Input Chinese Characters in English Windows XP

Enabling Chinese input is quick and easy, there are only... Read More

Linux ? Keyboard Or Mouse

Just stress testing one of the latest Linux distributions. Been... Read More

Blind CC (Bcc): Master Its Use When E-Mailing

If you use Microsoft Outlook (or similar applications) for e-mailing,... Read More

Linux Secrets

The first thing that you will notice about Linux Red... Read More

Builders Beware

Which Type of Shop Can Rely On A Home Built... Read More

Microsoft Great Plains Jewelry ? Implementation & Customization Overview

Each Industry and market niche has business specific and unique... Read More

Oracle Development: JDeveloper 10G ? Java, J2EE, EJB, MVC, XML - Overview For Programmer

In 2004 Oracle, Inc. made its new step toward J2EE... Read More

Microsoft CRM and No-Frills Cadillacs

In today's business world it's all but impossible to escape... Read More