Snort's inspector modules are used to significantly expand its
capabilities beyond decoding and pattern matching.
In this clip,
we're going to explore two of these inspector modules and
follow it up with a demo on where we can use them to help
protect Globomantics' network.
Before we go into that,
let's cover what these modules are and what they're used for.
Inspector modules allow Snort to detect more
sophisticated traffic, attacks, and anomalies.
They can also be used to perform administrative functions and enforce
policies regarding the use of different applications.
Each module performs a specific function,
expanding Snort's detection capabilities.
At the time this course was made,
there are 45 different inspector modules listed in the Snort manual.
Each build the process a different type of traffic
or perform a detection function.
The two inspector modules we will explore in this
course are AppId and Port Scan modules,
which enables Snort to detect applications and port scans.
Enabling this detection allows you to write rules to
take actions on this type of traffic.
Instead of identifying the traffic solely on source
destination, port number, and packet content,
you can now include the application ID. Let's take a closer
look at AppId and its function. AppId is able to identify
applications when processing packets.
This enables it to track the applications associated with each
packet and provide these identifiers to Snort rules.
Rule writers can then use these identifications to
take actions on these packets.
AppId also has the ability to output usage statistics,
allowing administrators to determine what applications are in use on
their network and the frequency of that usage.
These identifications are based on predefined applications obtained from Snort.
If you followed the install guide,
you obtained these when you downloaded the ODP directory. AppId is
not limited to these predefined applications.
Rule writers can create custom detectors as well.
In the last module, we had a rule configured to alert us on Facebook usage,
but you might've also noticed that AppId was able to detect
the Firefox browser I used to navigate to Metasploitable's web
pages using its predefined list.
Let's take a look at how to configure AppId and an example rule
leveraging its capability. Enabling AppId with default options could
not be easier. As with many of the Snort modules,
enabling it with default settings is as simple as entering the name of
the module and setting it equal to empty brackets.
Once enabled,
AppId can be leveraging rules to generate alerts based on application identity.
This example rule will alert on any incoming SSH or Telnet
traffic destined for my internal network.
Although this is a simple rule that would benefit from some additional
configuration, this will function and generate alerts for this traffic
and ignore other inbound TCP traffic.
Now that we understand AppId, let's cover Port Scan.
The Port Scan module is built to detect network reconnaissance
attempts conducted through report scans.
It was specifically designed to detect and map scans.
The reason for the end Nmap focus listed in Snort's manual is
that the developers of the Port Scan module determined that this
was the primary tool used for port scanning. Port Scan was
designed to detect TCP, UDP,
and IP port scans conducted using Nmap, as well as
variations of these scan types, including decoy scans,
distributed scans, port sweeps, and filtered scans.
These port scan types and variations are designed to evade
intrusion detection systems. To make configuration easy, Port
Scan comes with three default settings, low,
medium, and hi. It is not limited to these three levels and
enables more granular configuration if desired.
Let's look at an example configuration.
The Port Scan module is enabled by default and set to medium in the
snort.lua file. To change the default setting to a different value, you can
simply replace the medium value with either low or hi,
depending on your preference.
A quick note that hi is not a typo. To change it to the high setting,
you need to enter hi. You can further just the values
associated with each default level in the snort default's
.lua file we explored in the last module.
Now that we understand how to configure and use two inspector
modules, we're ready to further secure Globomantics' network by
enhancing our detection capabilities.