Snort for Network IDS

What is Snort?

Snort is an open source network intrusion detection system (NIDS) that can audit network traffic in real-time. Snort is a packet sniffer, a packet logger, and a network intrusion detection system.

Snort as I mentioned before is an open source software which means it can be configured and complied on most operating systems. Snort has been ported over to Microsoft Windows operating systems also, but it's bread and butter is back on the UNIX/Linux side of the house. Most Linux distributions now include Snort as part of their install package, and though it may not be enabled by default, normally it is on the installation CD's or DVD's.

Should I run Snort if I have a firewall?

I believe that yes you should run a NDIS even with a firewall. Firewalls help to block packets coming in to your system, however if you are running different servers or services that require the firewall to let them through you are letting a large amount of data go un-audited. Snort has the ability to see trends in incoming data and identify them as a threat and take appropriate action on your system. Snort gives you the ability to see if you are being port scanned, or to see if someone is trying to abuse well known backdoors or problems in well known daemons. Running services and applications that help you to protect your system is always a good idea. Many system administrators run a firewall, snort, and a data file integrity checker (often Tripwire).

How does snort actually work?

Snort generally is running as a background application and it is constantly packet sniffing all the information passing through your network interface card (NIC). The data is then sorted by various preprocessors that basically sort the packet data in to different categories. Once the data has been sorted out it is run through the rules, or the detection phase. As Snort detects trends in the data it applies the rules and actions them appropriately. The final stages are logging the rule infractions and if configured alerting the system administration team in real-time as the infraction occurs.

Is Snort difficult to configure and use?

Snort, as mentioned before now often comes bundled or available through rpm's in most Linux distributions. The hard part of running snort is if you decide to create your own original rules which can get extremely complex. However, luckily for us you can download up to date rule sets for free off the Snort website (you must signup for the free registration).

For extra ease of use there are many different applications and log parsers which have been designed to work with Snort. These applications can create websites based on the data Snort has logged or help you identify trends or possibly security threats on your system.

Ken Dennis
http://KenDennis-RSS.homeip.net/

---

Should I Use Windows Update?

Should one use Windows Update?This topic has good and valid... Read More

Cross-Platform Custom Software Development & Integration ? IT Strategy for Large Corporation

Microsoft Business Solutions products: Great Plains, MS CRM, Navision, Axapta,... Read More

Best Spyware Removers

Finding the best spyware removers to detect and remove spyware... Read More

Screenshots Vista Windows

Features Additionally, Vista will include many other new features.Aero Vista... Read More

Microsoft CRM Programming Secrets ? Tips For Developers

This article is for advanced Microsoft CRM SDK C# developers.... Read More

New SQL Delta Version 3.1

COMMAND LINE FUNCTIONA powerful command line script processor has been... Read More

Spyware, What is it?

Spyware, what it is and what it does. Basically, spyware... Read More

Microsoft Great Plains Payroll Module Customization Scenarios

It is now common thing when large corporation selects mid-market... Read More

Partitioning, Formatting and Reinstalling in Windows 98

Formatting and reinstalling windows 98 is very easy if you... Read More

Microsoft Great Plains on Ctree or Pervasive SQL ? What to Do ? Tips for IT Manager

As you probably know, when Microsoft purchased Great Plains Software... Read More

Review of TikiWiki Content Management System

TikiWiki is open source software - it is written in... Read More

Protect Your Most Vital Business Asset with Security Software

Homeland security, airport security, Internet security â?" these days weâ??re... Read More

Will Adobe Manage to Replace Industry Work Horse Quark Express by Giving Adobe InDesign for Free?

Heard about the Quark "killer"?Adobe InDesign CS2. Will it really... Read More

Microsoft CRM Customization Secrets ? Second Edition

This article is for advanced Microsoft CRM SDK C# developers.... Read More

A Guide To Purchasing Professional XP Icons Online And Enhancing Your Applications

Icons are used everywhere; right from software applications, to internet... Read More

Microsoft CRM Implementation & Customization: MS CRM Fax Gateway

With this small article we are continuing Microsoft Business Solutions... Read More

Tripwire for Linux File Integrity

What is Tripwire?Tripwire is a form intrusion detection system (IDS)... Read More

Microsoft CRM Modification ? Overview for IT Specialist

Microsoft CRM is now on the scene and it is... Read More

.NET :Solving the Multiple Inheritance Issue Under .NET Platform

.NET platform does not support multiple inheritance. Do not confuse... Read More

How To Develop Software For Your Business

Software development is a risky business.Many software developers are barely... Read More

Tools for Customizing Great Plains

Microsoft Business Solutions ? Great Plains has captured the US... Read More

Microsoft Great Plains Data Conversion ? Overview For Developer

Looks like Microsoft Great Plains becomes more and more popular,... Read More

Microsoft Great Plains PM: Payables Management

Microsoft Business Solutions Great Plains is marketed for mid-size companies... Read More

Device Driver Basics

Most people understand that the "hardware" part of their computer... Read More

Why Java RDBMS?

It is a well known fact that Java as a... Read More

Anti-Virus Software

Anti-virus software is used to find, remove or fix files... Read More

How to Make Attractive and Effective PowerPoint Presentations

Microsoft PowerPoint has dramatically changed the way in which academic... Read More

Lotus Domino: Reports and Connectors ? Crystal Reports, XML, ODBC/JDBC, OLE

Lotus Notes Domino is very efficient in electronic document workflow... Read More

Microsoft Great Plains POP: Purchase Order Processing ? Overview For Consultants

Great Plains Purchase Order Processing (POP) module makes up one-third... Read More

Who?s Watching What You Type?

If someone entered your home, uninvited and installed numerous cameras... Read More

Corporate Accounting System: Microsoft Great Plains ? Overview

Corporate ERP/MRP selection might be tough one, especially considering very... Read More

Microsoft Great Plains Furniture & Fixtures ? Implementation & Customization Highlights

Microsoft Great Plains, former Great Plains Software Dynamics / eEnterprise... Read More

20 Extra Hours Per Week: What Would You Do?

While I was in college, if you would have asked... Read More