4.0 KiB
Snort
Comprised of packet decoder, pre processor, detection engine, logging and alerting, output and plugins
Data Aquisition Modules
- Pcap, default
- Afpacket, inline mode, IPS
- Ipq, uses netfilter on linux
- Nfq, inline mode on linux
- Ipfw, inline mode on BSD
- Dump, test mode
Usage
- Check config, and run tests via
snort -c <config> -T
Sniffing
| Parameter | Description | +-----------+-------------+ | -v | Verbose. Display the TCP/IP output in the console.| | -d | Display the packet data (payload).| | -e | Display the link-layer (TCP/IP/UDP/ICMP) headers. | | -X | Display the full packet details in HEX.| | -i | Liste on interface |
Packet Logger
- Logged by IP as directory, ports as files inside these dirs
- BPF filter can be used like
tcp port 80 - Log files can be opened by wireshark or tcpdump
| Parameter | Description |
|---|---|
| -l | Logger mode, target log and alert output directory. Default output folder is tcpdump to /var/log/snort. |
| -K ASCII | Log packets in ASCII format |
| -r | Filter dumped logs in Snort |
| -n | Specify the number of packets that will be read |
IDS and IPS
- Output is an alert file along an optional log file
| Parameter | Description |
|---|---|
| -c | Defining the configuration file |
| -T | Testing the configuration file |
| -N | Disable logging |
| -D | Background mode |
| -A | Alert modes; full: all possible info about alerts, default mode; fast : alert message, timestamp, source and destination IP, port numbers. console: Provides fast style alerts on the console screen. cmg: CMG style, basic header details with payload in hex and text format. none: Disabling alerting |
- Rules found in
/etc/snort/rules/local.rules
alert icmp any any <> any any (msg: "ICMP Packet Found"; sid: 100001; rev:1;)
PCAPs
snort -c <configfile> -r file.pcap -A console -n <number of packets>snort -c <configfile> --pcap-list="file1.pcap file2.pcap" -A console -l .
Rules
snort -c /etc/snort/rules/local.rules -A console
snort -c /etc/snort/rules/local.rules -A full
-
Every rule has an IP source and destination, as well as a port for every endpoint
-
General, payload and non payload rules
-
Direction of the packet
->to destination<>bidirectional
-
IDS ->
alert -
IPS ->
reject
<action> <protocol> <ip.src> <src.port> <> <ip.dst> <dst.port>(msg: "<msg>; <reference>; <ruleID>;<revision info>
-
Actions
alertlogdropreject
-
SID rule IDs
- < 100 reserved rules
- 100 - 999,999 rules of the build
-
= 1,000,000 user rules
-
Reference may be a CVE
-
Revisions are versionings of the rule
-
Filter address range via CIDR
alert icmp 192.168.1.0/24 any <> any any (msg: "ICMP Packet Found"; sid: 100001; rev:1;)
- Filter multiple address ranges
alert icmp [192.168.1.0/24, 10.1.1.0/24] any <> any any (msg: "ICMP Packet Found"; sid: 100001; rev:1;)
- Exlude via
!10.10.0.1 - Filter via any and ports between 4712 and 8080
alert icmp any 4711,8080: <> any any (msg: "TCP Packet Found"; sid: 100001; rev:1;)
Detection Rules
/etc/snort/rules/local.rules- ASCII or gex mode
ASCII mode - alert tcp any any -> any 8080 (msg: "GET Request Found"; content:"GET"; sid: 100001; rev:1;)
alert tcp any any -> any 8080 (msg: "GET Request Found"; content:"|47 45 54|"; sid: 100001; rev:1;)
- Case insensitiv
alert tcp any any -> any 8080 (msg: "GET Request Found"; content:"GET"; nocase; sid: 100001; rev:1;)
- Fast pattern
alert tcp any any <> any 80 (msg: "GET Request Found"; content:"GET"; fast_pattern; content:"www"; sid:100001; rev:1;)
- Non payload detection rules
- TCP flags,
flags: F,S,A,R,P,U - Payload size,
dsize:min<>max - SameIP,
alert ip any any <> any any (msg: "SAME-IP TEST"; sameip; sid: 100001; rev:1;) - Packet IDs,
id: 4711
- TCP flags,