This demo is a continuation of the previous demo where we wrote
five rules to check for specific traffic.
This time,
we're going to test each of the rules to see if our
security goals are satisfied.
Let's head over to the Snort VM and get started.
Before we conduct the test, we need to activate Snort.
I'll use the same command as the last demo.
Now that we're ready,
let's go to the Kali VM and run the first test. To test our TTL rule, we
need to send a traceroute to the internal IP 10.0.0.100.
Now that that's complete, let's check Snort,
and our rule alerted us as we expected.
Now we have to test using Windows.
I'm going to use my Windows host that these VMs are running on for that test,
and now we can check back in with Snort, and the rule
for ICMP traceroutes worked as well.
We accomplished the first security goal.
Now let's see if Snort will block large ICMP packets.
We can use Kali for this test,
but we'll first need to see if a basic ping still
goes through and that ping succeeds.
Now we can use the ‑s option to set a packet size of 1024,
the minimum that Globomantics wanted us to block and we'll
see if that can get past Snort.
And we sent eight packets that all failed.
Let's check Snort.
And there is all the drop notifications satisfying the second security
goal. Last, we need to check if Nmap Xmas scans are detected by Snort. To
run an Xmas scan, we'll use Nmap with the ‑sX option. Instead of scanning
the whole range, I'm just going to scan the single IP and the scan went
through as expected.
Remember, we were just alerting on these packets.
Let's check Snort,
and we have our Xmas scan alerts satisfying our last security goal for
this demo. Before we move on with this module, let's do a quick recap of
what we covered between these two demos.
We started out in the first demo determining how we could use
each of the non‑payload detection options we discussed to
satisfy Globomantics security goals.
We then configured rules leveraging these options to detect the specific
traffic, and in the case of our large ICMP packets,
drop it.
After configuring the rules,
we tested each of them using traceroute, Nmap scans, and the large pings,
and we verified that all of our rules alerted or
dropped the traffic as expected.