Well,
we've come to the end of this module introducing you to
Snort. Let's take a look at the summary to review what we
learned so far in this course.
We started out this module discussing what Snort could be used for,
different placement options, and how it's configured.
We also explored the high‑level process flow to understand Snort's
basic operation once it receives a network packet.
We then discussed some of the differences between Snort 2.0 and version
3.0. Once we had the fundamental understanding, we started up our own
instance and captured our first few packets.
Once we got Snort running,
we learned how to use the snort.conf file to change Snort's
configuration and then made a few modifications to the sample
config included with our installation.
Next, we obtain the community and registered rules from snort.org.
We enable these rules and viewed the generated alerts.
If you're new to Snort, and even more so, if you're
new to the Linux environment,
I hope you leave this module feeling more confident starting Snort
and making changes to the configuration file.
If you're ready to move on,
we'll explore more of Snort's features and modules to learn about how
to configure Snort to detect additional attacks based on traffic
patterns and application IDs in the next module.