Snort Cookbook: Solutions and Examples for Snort Administrators

by Angela Orebaugh, Simon Biles, Jacob Babbin

Overview

If you are a network administrator, you're under a lot of pressure to ensure that mission-critical systems are completely safe from malicious code, buffer overflows, stealth port scans, SMB probes, OS fingerprinting attempts, CGI attacks, and other network intruders. Designing a reliable way to detect intruders before they get in is an essential--but often overwhelming--challenge. Snort, the defacto open source standard of intrusion detection tools, is capable of performing real-time traffic analysis and packet logging on IP network. It can perform protocol analysis, content searching, and matching. Snort can save countless headaches; the new Snort Cookbook will save countless hours of sifting through dubious online advice or wordy tutorials in order to leverage the full power of SNORT.Each recipe in the popular and practical problem-solution-discussion O'Reilly cookbook format contains a clear and thorough description of the problem, a concise but complete discussion of a solution, and real-world examples that illustrate that solution. The Snort Cookbook covers important issues that sys admins and security pros will us everyday, such as:

• installation
• optimization
• logging
• alerting
• rules and signatures
• detecting viruses
• countermeasures
• detecting common attacks
• administration
• honeypots
• log analysis

But the Snort Cookbook offers far more than quick cut-and-paste solutions to frustrating security issues. Those who learn best in the trenches--and don't have the hours to spare to pore over tutorials or troll online for best-practice snippets of advice--will find that the solutions offered in this ultimate Snort sourcebook not only solve immediate problems quickly, but also showcase the best tips and tricks they need to master be security gurus--and still have a life.

Product Details

ISBN-13:	9780596552701
Publisher:	O'Reilly Media, Incorporated
Publication date:	03/29/2005
Sold by:	Barnes & Noble
Format:	eBook
Pages:	288
File size:	3 MB

About the Author

Angela Orebaugh is an information security technologist, scientist, and author with a broad spectrum of expertise in information assurance. She synergizes her 15 years of hands-on experiences within industry, academia, and government to advise clients on information assurance strategy, management, and technologies.



Ms. Orebaugh is involved in several security initiatives with the National Institute of Standards and Technology (NIST), including technical Special Publications (800 series), the National Vulnerability Database (NVD), Security Content Automation Protocol (SCAP) project, and secure eVoting.



Ms. Orebaugh is an Adjunct Professor for George Mason Universitywhere she performs research and teaching in intrusion detection and forensics. She developed and teaches the Intrusion Detection curriculum, a core requirement for the Forensics program in the Department of Electrical and Computer Engineering. Her current research interests include peer-reviewed publications in the areas of intrusion detection and prevention, data mining, attacker profiling, user behavior analysis, and network forensics.



Ms. Orebaugh is the author of the Syngress best seller's Nmap in the Enterprise, Wireshark and Ethereal Network Protocol Analyzer Toolkit, and Ethereal Packet Sniffing. She has also co-authored the Snort Cookbook, Intrusion Prevention and Active Response, and How to Cheat at Configuring Open Source Security Tools. Angela is a frequent speaker at a variety of security conferences and technology events, including the SANS Institute and The Institute for Applied Network Security.



Ms. Orebaugh holds a Masters degree in Computer Science and a Bachelors degree in Computer Information Systems from James Madison University. She is currently completing her dissertation for her Ph.D. at George Mason University, with a concentration in Information Security.

Simon Biles is currently Director of Thinking Security Ltd. an Information Security Consultancy based near Oxford in the UK. The company deals with all aspects of InfoSec from Incident Response and Forensics through to ISO 27001 work. He is currently studying for his MSc in Forensic Computing at Shrivenham with Cranfield University. He holds a CISSP, is Certified as an ISO17799 Lead Auditor, is a Chartered IT Professional with the British Computer Society and is also a member of F3 - the UK's First Forensic Forum. Currently he is involved in a project to define and support best practices in Forensics - you can find out more about this at the Open Forensics Group.

Jake Babbin works as a contractor with a government agency filling the role of Intrusion Detection Team Lead. He has worked in both private industry as a security professional and in government space in a variety of IT security roles. He is a speaker at several IT security conferences and is a frequent assistant in SANS Security Essentials Bootcamp, Incident Handling and Forensics courses. Jake lives in Virginia.

Table of Contents

	Preface	vii
1	Installation and Optimization	1
1.1	Installing Snort from Source on Unix	1
1.2	Installing Snort Binaries on Linux	4
1.3	Installing Snort on Solaris	5
1.4	Installing Snort on Windows	7
1.5	Uninstalling Snort from Windows	12
1.6	Installing Snort on Mac OS X	14
1.7	Uninstalling Snort from Linux	16
1.8	Upgrading Snort on Linux	17
1.9	Monitoring Multiple Network Interfaces	17
1.10	Invisibly Tapping a Hub	19
1.11	Invisibly Sniffing Between Two Network Points	19
1.12	Invisibly Sniffing 100 MB Ethernet	21
1.13	Sniffing Gigabit Ethernet	22
1.14	Tapping a Wireless Network	23
1.15	Positioning Your IDS Sensors	24
1.16	Capturing and Viewing Packets	27
1.17	Logging Packets That Snort Captures	30
1.18	Running Snort to Detect Intrusions	33
1.19	Reading a Saved Capture File	35
1.20	Running Snort as a Linux Daemon	36
1.21	Running Snort as a Windows Service	37
1.22	Capturing Without Putting the Interface into Promiscuous Mode	39
1.23	Reloading Snort Settings	39
1.24	Debugging Snort Rules	40
1.25	Building a Distributed IDS (Plain Text)	41
1.26	Building a Distributed IDS (Encrypted)	44
2	Logging, Alerts, and Output Plug-ins	51
2.1	Logging to a File Quickly	51
2.2	Logging Only Alerts	52
2.3	Logging to a CSV File	54
2.4	Logging to a Specific File	56
2.5	Logging to Multiple Locations	56
2.6	Logging in Binary	58
2.7	Viewing Traffic While Logging	60
2.8	Logging Application Data	61
2.9	Logging to the Windows Event Viewer	63
2.10	Logging Alerts to a Database	64
2.11	Installing and Configuring MySQL	65
2.12	Configuring MySQL for Snort	67
2.13	Using PostgreSQL with Snort and ACID	70
2.14	Logging in PCAP Format (TCPDump)	74
2.15	Logging to Email	75
2.16	Logging to a Pager or Cell Phone	77
2.17	Optimizing Logging	78
2.18	Reading Unified Logged Data	80
2.19	Generating Real-Time Alerts	81
2.20	Ignoring Some Alerts	82
2.21	Logging to System Logfiles	82
2.22	Fast Logging	83
2.23	Logging to a Unix Socket	84
2.24	Not Logging	86
2.25	Prioritizing Alerts	87
2.26	Capturing Traffic from a Specific TCP Session	88
2.27	Killing a Specific Session	89
3	Rules and Signatures	90
3.1	How to Build Rules	90
3.2	Keeping the Rules Up to Date	94
3.3	Basic Rules You Shouldn't Leave Home Without	98
3.4	Dynamic Rules	100
3.5	Detecting Binary Content	102
3.6	Detecting Malware	103
3.7	Detecting Viruses	104
3.8	Detecting IM	105
3.9	Detecting P2P	107
3.10	Detecting IDS Evasion	110
3.11	Countermeasures from Rules	114
3.12	Testing Rules	115
3.13	Optimizing Rules	116
3.14	Blocking Attacks in Real Time	117
3.15	Suppressing Rules	118
3.16	Thresholding Alerts	118
3.17	Excluding from Logging	119
3.18	Carrying Out Statistical Analysis	120
4	Preprocessing: An Introduction	125
4.1	Detecting Stateless Attacks and Stream Reassembly	126
4.2	Detecting Fragmentation Attacks and Fragment Reassembly with Frag2	131
4.3	Detecting and Normalizing HTTP Traffic	136
4.4	Decoding Application Traffic	141
4.5	Detecting Port Scans and Talkative Hosts	142
4.6	Getting Performance Metrics	149
4.7	Experimental Preprocessors	155
4.8	Writing Your Own Preprocessor	156
5	Administrative Tools	157
5.1	Managing Snort Sensors	157
5.2	Installing and Configuring IDScenter	159
5.3	Installing and Configuring SnortCenter	167
5.4	Installing and Configuring Snortsnarf	173
5.5	Running Snortsnarf Automatically	175
5.6	Installing and Configuring ACID	175
5.7	Securing ACID	180
5.8	Installing and Configuring Swatch	181
5.9	Installing and Configuring Barnyard	183
5.10	Administering Snort with IDS Policy Manager	184
5.11	Integrating Snort with Webmin	190
5.12	Administering Snort with HenWen	196
5.13	Newbies Playing with Snort Using EagleX	201
6	Log Analysis	203
6.1	Generating Statistical Output from Snort Logs	203
6.2	Generating Statistical Output from Snort Databases	207
6.3	Performing Real-Time Data Analysis	208
6.4	Generating Text-Based Log Analysis	212
6.5	Creating HTML Log Analysis Output	214
6.6	Tools for Testing Signatures	215
6.7	Analyzing and Graphing Logs	220
6.8	Analyzing Sniffed (Pcap) Traffic	223
6.9	Writing Output Plug-ins	224
7	Miscellaneous Other Uses	225
7.1	Monitoring Network Performance	225
7.2	Logging Application Traffic	233
7.3	Recognizing HTTP Traffic on Unusual Ports	234
7.4	Creating a Reactive IDS	235
7.5	Monitoring a Network Using Policy-Based IDS	238
7.6	Port Knocking	240
7.7	Obfuscating IP Addresses	243
7.8	Passive OS Fingerprinting	244
7.9	Working with Honeypots and Honeynets	250
7.10	Performing Forensics Using Snort	252
7.11	Snort and Investigations	253
7.12	Snort as Legal Evidence in the U.S.	257
7.13	Snort as Evidence in the U.K.	258
7.14	Snort as a Virus Detection Tool	260
7.15	Staying Legal	263
	Index	265