To protect Globomantics, we settled on Snort as our
intrusion detection and prevention system.
If you haven't used Snort before,
you're probably wondering what Snort is or why we would
select it to serve this function.
Snort is a signature‑based intrusion detection and prevention system.
The software is available for free at snort.org,
which also contains multiple tutorials to install it on your chosen system.
As a signature‑based system,
Snort detects attacks through specified patterns and
known malicious packet sequences.
It does this detection using multiple tools, also called modules.
These modules reassemble and normalize incoming packets.
Previous versions of Snort refer to these modules as preprocessors.
Once traffic is decoded and normalized, Snort then uses a set of
rules configured to match specific traffic patterns,
protocols or sequences, and then take a specified action. When
using Snort as an intrusion detection system,
this action is typically an alert,
but changing this action is used to turn Snort from its design function
as an IDS and enable intrusion prevention by choosing an action of
dropping the match traffic instead of only generating an alert. Writing
your own rules to match any malicious traffic you can think of is a
complex and intensive task, which is beyond the scope of this course.
But don't worry, Snort has multiple options to obtain prewritten
community rules for free and paid subscription options to get you up
and running quickly. We'll obtain some of these rules and explore how
to use them later in this module.
Now that we understand what Snort is,
let's take a look at a few visual depictions of high‑level process flow
and discuss two placement options for a Snort server.
When a packet is sent to our target, it first passes through the Snort server,
which will process the packet through its modules and then attempt
to match the pattern or signature to a rule.
If a match is detected,
Snort will generate an alert and then take a
follow‑on action to log the traffic,
and it can be configured to also drop the packet.
If approved, Snort will forward the packet on to its destination.
Let's take a closer look at that processing step.
When a packet is received by Snort,
it first goes through a decoding process where the traffic
is normalized to enable rule detection.
Snort then sends the packet through a preprocessing phase.
This phase is where the configured modules are used to detect complex attacks.
Once the traffic is processed,
Snort evaluates it against a rule set to detect potential
attacks. After the evaluation, Snort can make a decision on
whether to generate an alert,
take a follow‑on action or forward the packet onto its destination.
The follow‑on action to drop the packets is only available when
Snort is configured in inline mode where all the traffic flows
through Snort before reaching its destination.
As mentioned earlier,
dropping packets enables configuration of Snort as an
intrusion prevention system, or IPS, instead of solely as an
intrusion detection system, or IDS.
Another possible placement is on a switch port configured
to mirror another port on the switch, connecting the
internal and external networks.
This allows Snort to receive packets, process them, and generate alerts.
However,
follow‑on actions are not effective In this configuration. The switch will
already have forwarded the packets on to their destination,
regardless of whether it matches a Snort rule or not.
Now that we have a high‑level understanding of how Snort operates,
we're almost ready to dive into Snort's configuration.
Before we do that,
let's take one quick look at the differences between
Snort version 2 and version 3.
After that, we'll explore the lab setup,
and then we'll be ready to dive into some configuration.