Chapter 19 intrusion detection systems
the unauthorized reproduction in whole or in part of this publication in any form is prohibited.
We will now copy the tools we need from the desk enclosed with the set
before compiling the stored application.
We must first prepare the IBP cap library.
Let's take care of it.
The next step is the compilation and installation of the program.
The program compilation process can take a couple of minutes depending on the speed of the computer.
After terminating the compilation installation in the system we can proceed with the configuration of
the program.
Finally we start snort and observe the results on the screen.
The port 22 has been excluded in order to make the report's content possibly readable
as we can see the exact content of each packet is shown on the screen
after interrupting snort general statistics of the registered packets will be shown
Additionally each packet has been saved in the assigned directory.
This is a very useful function.
The invaluable characteristic of snort is the ability to create rules according to which the program
will write or discard the packets.
Let's take a look at an example rule file and analyze it structure a detailed description of the creation
of rules is to be found in the handbook.
Let's make a small modification of the rules file and check its function
as we can see the rules defined earlier have been adapted to events occurring in the network.
Let's now test the function of another program from the idea family Portes entry.
After a moment the program is ready to work.
Let's check its function by detecting the TCAP port scanning
as we can see the program register the scanning attempt and efficiently prevented it from carrying out
a potential attack.