Podcast
Questions and Answers
What is a limitation of Snort in regards to encrypted traffic?
What is a limitation of Snort in regards to encrypted traffic?
- It can check for intrusion by checking SSL Proxies
- It cannot check for intrusion (correct)
- It cannot detect SSL Proxies
- It can decrypt encrypted traffic
What is the name of the program that can connect Snort to a database?
What is the name of the program that can connect Snort to a database?
- SnortDB
- SensorConnect
- Barnyard2 (correct)
- Barnyard
Why might someone choose to use a Linux-based operating system for their Snort sensor?
Why might someone choose to use a Linux-based operating system for their Snort sensor?
- Because Snort is only available on Linux
- Because Linux is more user-friendly than Windows
- Because Linux is more secure than Windows
- Because the Windows version of Snort is no longer supported (correct)
What is an important consideration when choosing the base operating system for a Snort sensor?
What is an important consideration when choosing the base operating system for a Snort sensor?
What is one way to ensure the security of a Snort sensor?
What is one way to ensure the security of a Snort sensor?
What is the purpose of Interface Pairing and SPAN in a Snort sensor?
What is the purpose of Interface Pairing and SPAN in a Snort sensor?
What is a limitation of using open-source software like Snort?
What is a limitation of using open-source software like Snort?
What is the primary function of a NIDS like Snort?
What is the primary function of a NIDS like Snort?
Why is it recommended to not place a NIDS inline with network connections?
Why is it recommended to not place a NIDS inline with network connections?
What is a Snort Sensor?
What is a Snort Sensor?
Why is it important to prioritize which systems to watch with a NIDS?
Why is it important to prioritize which systems to watch with a NIDS?
What is the purpose of a SPAN port on Cisco hardware?
What is the purpose of a SPAN port on Cisco hardware?
What is a limitation of using modern switches with a NIDS?
What is a limitation of using modern switches with a NIDS?
Why is it recommended to use a hub to create a listening point in a network?
Why is it recommended to use a hub to create a listening point in a network?
What is the benefit of using Cisco hardware with Snort?
What is the benefit of using Cisco hardware with Snort?
What is the purpose of manual user intervention in a NIDS like Snort?
What is the purpose of manual user intervention in a NIDS like Snort?
What is a crucial step in deploying Snort effectively?
What is a crucial step in deploying Snort effectively?
Why is Snort not a plug and watch solution?
Why is Snort not a plug and watch solution?
What is the primary purpose of a NIDS like Snort?
What is the primary purpose of a NIDS like Snort?
Why is it important to have a plan in place when using a NIDS like Snort?
Why is it important to have a plan in place when using a NIDS like Snort?
What should Snort be used in conjunction with?
What should Snort be used in conjunction with?
What is a limitation of Snort?
What is a limitation of Snort?
Why are there commented out rules in the community rules?
Why are there commented out rules in the community rules?
What is the purpose of community rules?
What is the purpose of community rules?
Why are not all active rules needed?
Why are not all active rules needed?
What is the purpose of commenting out rules in community rules?
What is the purpose of commenting out rules in community rules?
What should you do before implementing community rules?
What should you do before implementing community rules?
Why are some rules not commonly used?
Why are some rules not commonly used?
What is the purpose of the Attack-response.rules set?
What is the purpose of the Attack-response.rules set?
Where can you download rules from the Snort.org Rule set?
Where can you download rules from the Snort.org Rule set?
What is the purpose of the Ddos.rules set?
What is the purpose of the Ddos.rules set?
What is the purpose of the Experimental.rules set?
What is the purpose of the Experimental.rules set?
What command is used to extract the rules from the Snort.org Rule set?
What command is used to extract the rules from the Snort.org Rule set?
What is the purpose of the Deleted.rules set?
What is the purpose of the Deleted.rules set?
What is the purpose of the icmp-info.rules file?
What is the purpose of the icmp-info.rules file?
Which of the following rule categories is disabled by default and used to detect traffic sent from peer to peer services?
Which of the following rule categories is disabled by default and used to detect traffic sent from peer to peer services?
What is the minimum requirement for a Snort rule?
What is the minimum requirement for a Snort rule?
What is the purpose of the info.rules file?
What is the purpose of the info.rules file?
What is the purpose of the rpc.rules file?
What is the purpose of the rpc.rules file?
What is the purpose of the local.rules file?
What is the purpose of the local.rules file?
What is the purpose of the web-iis.rules file?
What is the purpose of the web-iis.rules file?
What is the purpose of the imap.rules file?
What is the purpose of the imap.rules file?
What is the purpose of the misc.rules file?
What is the purpose of the misc.rules file?
What is the purpose of the smtp.rules file?
What is the purpose of the smtp.rules file?
What is the purpose of the Backdoor.rules set?
What is the purpose of the Backdoor.rules set?
What is the purpose of the Bad-traffic.rules set?
What is the purpose of the Bad-traffic.rules set?
What is the purpose of the Dns.rules set?
What is the purpose of the Dns.rules set?
Where can you download rules from the Snort.org Rule set?
Where can you download rules from the Snort.org Rule set?
What is the purpose of the Experimental.rules set?
What is the purpose of the Experimental.rules set?
What command is used to extract the rules from the Snort.org Rule set?
What command is used to extract the rules from the Snort.org Rule set?
What is the main purpose of the icmp-info.rules file?
What is the main purpose of the icmp-info.rules file?
What is the minimum requirement for a Snort rule?
What is the minimum requirement for a Snort rule?
What does the 'Activate' rule action do?
What does the 'Activate' rule action do?
What is the purpose of the p2p.rules file?
What is the purpose of the p2p.rules file?
What is the purpose of the oracle.rules file?
What is the purpose of the oracle.rules file?
What does the 'Pass' rule action do?
What does the 'Pass' rule action do?
What is the purpose of the web-misc.rules file?
What is the purpose of the web-misc.rules file?
What is the purpose of the rpc.rules file?
What is the purpose of the rpc.rules file?
What is the purpose of the sql.rules file?
What is the purpose of the sql.rules file?
What is the purpose of the local.rules file?
What is the purpose of the local.rules file?
What is the first step in writing your first snort rule?
What is the first step in writing your first snort rule?
What is the purpose of the rule 'alert icmp any any any (msg:"ICMP detected";sid: 10001)'?
What is the purpose of the rule 'alert icmp any any any (msg:"ICMP detected";sid: 10001)'?
How do you test your snort rule after creating it?
How do you test your snort rule after creating it?
What command is used to start Snort in console mode?
What command is used to start Snort in console mode?
What do you need to do to the community.rules file in snort.conf?
What do you need to do to the community.rules file in snort.conf?
What is the minimum requirement for a Snort rule?
What is the minimum requirement for a Snort rule?
What is the purpose of the provided Python script?
What is the purpose of the provided Python script?
What command can be used to verify the Python version?
What command can be used to verify the Python version?
How many values are required to run a TCP packet test using the Python script?
How many values are required to run a TCP packet test using the Python script?
What is the recommended Python version to use with the script?
What is the recommended Python version to use with the script?
How do you start the Python script?
How do you start the Python script?
What type of protocol transactions can the Python script generate?
What type of protocol transactions can the Python script generate?
What type of IP should be entered for IP/URL in a TCP call?
What type of IP should be entered for IP/URL in a TCP call?
What happens if no open port is found at the entered IP/URL?
What happens if no open port is found at the entered IP/URL?
What is the purpose of running checkrule.py?
What is the purpose of running checkrule.py?
How many values need to be entered for a UDP packet call test?
How many values need to be entered for a UDP packet call test?
What is the consequence of not testing each rule individually?
What is the consequence of not testing each rule individually?
What is not required to be entered in the URL for a TCP call?
What is not required to be entered in the URL for a TCP call?
What is the primary purpose of checking the flag in a TCP rule?
What is the primary purpose of checking the flag in a TCP rule?
What is the result of not specifying the flag in a TCP rule?
What is the result of not specifying the flag in a TCP rule?
What type of communication is captured by a basic TCP rule without a filter?
What type of communication is captured by a basic TCP rule without a filter?
Why are the rules being written against outgoing packets?
Why are the rules being written against outgoing packets?
What is the purpose of a TCP rule?
What is the purpose of a TCP rule?
How many transactions occurred in the example of the TCP rule without a filter?
How many transactions occurred in the example of the TCP rule without a filter?
What is the purpose of applying a filter to a TCP rule?
What is the purpose of applying a filter to a TCP rule?
What is the main difference between a UDP rule and a TCP rule?
What is the main difference between a UDP rule and a TCP rule?
What is the purpose of the 'content' option in a UDP rule?
What is the purpose of the 'content' option in a UDP rule?
What is the purpose of the 'revision' option in a rule?
What is the purpose of the 'revision' option in a rule?
What is the purpose of the 'nocase' option in a rule?
What is the purpose of the 'nocase' option in a rule?
What is the purpose of the 'session' option in a rule?
What is the purpose of the 'session' option in a rule?
What is the purpose of the 'stateless' option in a rule?
What is the purpose of the 'stateless' option in a rule?
What is the result of applying a filter to a TCP rule?
What is the result of applying a filter to a TCP rule?
What is the benefit of using options in a rule?
What is the benefit of using options in a rule?
What is the purpose of creating a basic TCP rule with an applied filter?
What is the purpose of creating a basic TCP rule with an applied filter?
What is the primary function of Session Interception in an Intrusion Prevention System (IPS)?
What is the primary function of Session Interception in an Intrusion Prevention System (IPS)?
What is the risk associated with IPS identification?
What is the risk associated with IPS identification?
What is the purpose of the flexresp plugin in Snort?
What is the purpose of the flexresp plugin in Snort?
What is the primary function of Gateway Intrusion Detection in Snort?
What is the primary function of Gateway Intrusion Detection in Snort?
What is the risk associated with altering access lists in Snort?
What is the risk associated with altering access lists in Snort?
What is the primary function of SnortSAM in Snort?
What is the primary function of SnortSAM in Snort?
What is the purpose of the 'react' response rule option?
What is the purpose of the 'react' response rule option?
What is the function of the 'replace' rule option in Snort Inline?
What is the function of the 'replace' rule option in Snort Inline?
What is the function of SnortSAM?
What is the function of SnortSAM?
What is the function of the 'sdrop' action in Snort Inline?
What is the function of the 'sdrop' action in Snort Inline?
What is the purpose of the 'flexresp' plugin?
What is the purpose of the 'flexresp' plugin?
What is the difference between the 'drop' and 'sdrop' actions in Snort Inline?
What is the difference between the 'drop' and 'sdrop' actions in Snort Inline?
What is a limitation of SnortSAM?
What is a limitation of SnortSAM?
What is the purpose of the 'rst_snd' keyword in the 'flexresp' plugin?
What is the purpose of the 'rst_snd' keyword in the 'flexresp' plugin?
What is the purpose of Snort Inline?
What is the purpose of Snort Inline?
What is the requirement to enable flex response?
What is the requirement to enable flex response?
What is the primary function of Session Interception in an IPS?
What is the primary function of Session Interception in an IPS?
What is the risk associated with altering access lists in Snort?
What is the risk associated with altering access lists in Snort?
What is the purpose of the flexresp plugin in Snort?
What is the purpose of the flexresp plugin in Snort?
What can happen when Snort detects an attack and ends the TCP connection using RST?
What can happen when Snort detects an attack and ends the TCP connection using RST?
What is the primary function of SnortSAM in Snort?
What is the primary function of SnortSAM in Snort?
What can happen during the lag between the detect and the attack when SnortSAM is used?
What can happen during the lag between the detect and the attack when SnortSAM is used?
What is the purpose of the 'resp' rule option?
What is the purpose of the 'resp' rule option?
Which of the following plugins require changes to the Snort configuration?
Which of the following plugins require changes to the Snort configuration?
What is the purpose of the 'react' rule option?
What is the purpose of the 'react' rule option?
What is the purpose of the 'replace' rule option in Snort Inline?
What is the purpose of the 'replace' rule option in Snort Inline?
What is the purpose of SnortSAM?
What is the purpose of SnortSAM?
What is the difference between the 'drop' and 'sdrop' actions in Snort Inline?
What is the difference between the 'drop' and 'sdrop' actions in Snort Inline?
What is required to enable flex response?
What is required to enable flex response?
What is the limitation of using SnortSAM?
What is the limitation of using SnortSAM?
What is the purpose of the 'proxy' keyword in the react option?
What is the purpose of the 'proxy' keyword in the react option?
What is the requirement for using the react option?
What is the requirement for using the react option?
What is the purpose of the react rule option in Snort?
What is the purpose of the react rule option in Snort?
What happens when the content of a TCP packet matches the 'verybadthings' pattern in the Snort rule?
What happens when the content of a TCP packet matches the 'verybadthings' pattern in the Snort rule?
What is required to test the Snort rule with the react option?
What is required to test the Snort rule with the react option?
What is the purpose of the modified checkrule.py script?
What is the purpose of the modified checkrule.py script?
What is the purpose of the sid field in the Snort rule?
What is the purpose of the sid field in the Snort rule?
What is the result of adding the rule to the local.rules file?
What is the result of adding the rule to the local.rules file?
What is a false positive indicator?
What is a false positive indicator?
Why might you need to tune your IDS?
Why might you need to tune your IDS?
What is a potential cause of a false negative?
What is a potential cause of a false negative?
What is the purpose of the flow preprocessor?
What is the purpose of the flow preprocessor?
What should you do when verifying a rule that generates an unexpected alert?
What should you do when verifying a rule that generates an unexpected alert?
What is the purpose of uncommenting the decoder configurations?
What is the purpose of uncommenting the decoder configurations?
What should you do with rule sets that are not needed?
What should you do with rule sets that are not needed?
What is the problem with using pass rules?
What is the problem with using pass rules?
What is the purpose of the http_inspector preprocessor?
What is the purpose of the http_inspector preprocessor?
What is the advantage of suppression rules over thresholding rules?
What is the advantage of suppression rules over thresholding rules?
What should you do with individual rules in a rule set that do not cover operations in your system?
What should you do with individual rules in a rule set that do not cover operations in your system?
What is the purpose of setting the reassemble to 'noalerts'?
What is the purpose of setting the reassemble to 'noalerts'?
What is the term for when a rule generates an unexpected alert or more alerts than expected?
What is the term for when a rule generates an unexpected alert or more alerts than expected?
Why is it necessary to tune your IDS?
Why is it necessary to tune your IDS?
What is the primary function of the flow preprocessor?
What is the primary function of the flow preprocessor?
What can be disabled if monitoring portscans is not important to your system?
What can be disabled if monitoring portscans is not important to your system?
What is a potential cause of a false negative?
What is a potential cause of a false negative?
What is the purpose of uncommenting decoder configurations?
What is the purpose of uncommenting decoder configurations?
What is the purpose of tailoring decoders and preprocessors in Snort?
What is the purpose of tailoring decoders and preprocessors in Snort?
Why should you disable the flow-portscan preprocessor if not tracking portscans?
Why should you disable the flow-portscan preprocessor if not tracking portscans?
What is the problem with using pass rules in Snort?
What is the problem with using pass rules in Snort?
What is the advantage of suppression rules over thresholding rules?
What is the advantage of suppression rules over thresholding rules?
Why should you comment out individual rules in a rule set that do not cover operations in your system?
Why should you comment out individual rules in a rule set that do not cover operations in your system?
What is the purpose of setting the reassemble to 'noalerts' in Snort?
What is the purpose of setting the reassemble to 'noalerts' in Snort?
What should you do when performing tuning?
What should you do when performing tuning?
What is the purpose of tailoring the rule set?
What is the purpose of tailoring the rule set?
Why should you avoid using pass rules?
Why should you avoid using pass rules?
What should you consider when tuning individual rules?
What should you consider when tuning individual rules?
What is the purpose of tuning individual rules?
What is the purpose of tuning individual rules?
Why should decoder configurations be commented out when developing rules?
Why should decoder configurations be commented out when developing rules?
What should you do with rules that are not specific enough?
What should you do with rules that are not specific enough?
What is the purpose of the flow preprocessor?
What is the purpose of the flow preprocessor?
When can the frag 3 preprocessor be disabled?
When can the frag 3 preprocessor be disabled?
What information does the http_inspector preprocessor provide?
What information does the http_inspector preprocessor provide?
What is the benefit of making a backup of your snort.conf file?
What is the benefit of making a backup of your snort.conf file?
Why should changes to the snort.conf file be made one at a time?
Why should changes to the snort.conf file be made one at a time?
What is the purpose of commenting out the decoder configurations?
What is the purpose of commenting out the decoder configurations?
When can the frag 3 preprocessor be disabled?
When can the frag 3 preprocessor be disabled?
What is the purpose of the flow preprocessor?
What is the purpose of the flow preprocessor?
What happens when the decoder configurations are uncommented?
What happens when the decoder configurations are uncommented?
What information does the http_inspector preprocessor provide?
What information does the http_inspector preprocessor provide?
Why is it recommended to make changes to the snort.conf file one at a time?
Why is it recommended to make changes to the snort.conf file one at a time?
What is the purpose of using the no_alerts option when performing tuning?
What is the purpose of using the no_alerts option when performing tuning?
What should you do with rules that are not common services run on a network?
What should you do with rules that are not common services run on a network?
What is the purpose of pass rules?
What is the purpose of pass rules?
What is a recommended approach when a rule cannot be specific enough?
What is a recommended approach when a rule cannot be specific enough?
Why is it recommended to avoid using pass rules?
Why is it recommended to avoid using pass rules?
What is the purpose of tuning individual rules?
What is the purpose of tuning individual rules?
Study Notes
Snort Tuning and Thresholding
• False Positives: Unexpected alerts or more alerts than expected, requiring rule verification to ensure it's not a real intrusion attempt. • False Negatives: Undetected intrusions, caused by traffic encryption, network configuration problems, day zero attacks, faulty signatures, poor change management, and Snort sensor administration problems.
Initial Configuration and Tuning
• Decoders and Preprocessors: + Uncomment decoder configurations + Disable unnecessary preprocessors (e.g., flow, frag, stream) based on system requirements + Set reassemble to "noalerts" for stream preprocessor • Tailoring Decoders and Preprocessors: + http_inspector preprocessor: set with no_alerts when not used for troubleshooting + flow-portscan preprocessor: disable if not tracking portscans • Tailoring the Rule Set: + Comment out unnecessary rule sets and individual rules + Restrict rule sets to only use web technology and database used in the system
Thresholding and Suppression
• Threshold Rules: + Limit: alert only the first X number of events + Threshold: alert every X times + Both: alert only the X number of thresholds • Global Thresholds: use sig_id set to 0, meaning all rules • Suppression Rules: similar to threshold rules, can suppress by signature, source or destination address, or CIDR network block
Using Snort as an IPS
• React Rule Option: used to block TCP sessions, e.g., blocking TCP packets containing "verybadthings"
Snort Limitations and Considerations
• Open Source: may have limited documentation and require troubleshooting • Configuration: only the first step, requiring manual user intervention and a plan to stop intrusions • NIDS: one layer in network security, should be used in conjunction with other layers (IPS, Firewall, VPN) • Initial Configuration: essential to success, consider systems, topography, and network environment • Sensor Placement: prioritize systems to watch, use natural bottlenecks, and enable port mirroring or use a hub
Deploying Snort
• Important Key Points: + Snort is not a plug-and-watch solution + Understand what protections Snort provides and how it affects network and defense systems + Snort can't check encrypted traffic, but can check SSL Proxies • Securing the Sensor: harden the sensor, disable unnecessary services, apply patches and updates, and utilize robust authentication • Connecting Sensors: connect Snort to a database to save alerts and tie them to a sensor### Snort Rules
- Snort rules are used to detect and alert on various types of network traffic
- There are different types of rule sets available, including:
- Exploit rules: detect known exploits
- Finger rules: detect known types of finger attacks
- FTP rules: detect known file transfer protocol attacks
- ICMP-info rules: detect ICMP issues (not enabled by default)
- IMAP rules: detect attacks against IMAP email services
- Info rules: detect normal traffic on a healthy, secure network (not enabled by default)
- Local rules: holds all custom rules created
- Misc rules: holds rules that are not included in other categories
- Multimedia rules: detect multimedia that is against company policy (not enabled by default)
- MySQL rules: detect attacks against MySQL servers
- Netbios rules: detect attacks against Windows systems using the NetBIOS protocol
- NNTP rules: detect attacks against the Network Time Protocol
- Oracle rules: detect attacks against Oracle database servers
- Other-IDS rules: detect traffic from other IDS services
- P2P rules: detect traffic sent from peer-to-peer services (disabled by default)
- Policy rules: detect traffic sent from security policy violating services (disabled by default)
- Pop2 rules: detect attacks against POP2 email services
- Pop3 rules: detect attacks against POP3 email services
- Porn rules: detect a variety of off-color packets (disabled by default)
- RPC rules: detect attacks against remote procedure call (RPC) services
- Rservices rules: detect attacks against remote services (rsh, rlogin, rexec)
- Scan rules: detect attacks against a variety of network and service scans
- Shellcode rules: detect shell code in packet payloads (disabled by default)
- SMTP rules: detect attacks against SMTP mail services
- SQL rules: detect attacks against MSSQL Database servers
- Telnet rules: detect attacks against telnet services
- TFTP rules: detect attacks against TFTP Services
- Virus rules: detect viruses (disabled by default, not used or maintained)
- Web-attack rules: detect web attacks (disabled by default, not used or maintained)
- Web-cgi rules: detect attacks against Common Gateway Interface (CGI) services
- Web-client rules: detect attacks against mainly Microsoft Outlook services
- Web-coldfusion rules: detect attacks against ColdFusion web application services
- Web-frontpage rules: detect attacks against Microsoft FrontPage web authoring services
- Web-iis rules: detect attacks against Microsoft Internet Information Server (IIS) web services
- Web-misc rules: detect attacks against common web attacks
- Web-php rules: detect attacks against webservers running PHP application services
- X11 rules: detect attacks against remote X-Windows services
Creating Your Own Rules
- To create your own rule, you need to add it to any of the existing rules packs
- The syntax for creating a rule includes:
- "sid" option: the rule ID
- "msg" option: a unique message describing what the rule has detected
- Rule actions:
- Alert: alerts and logs the packet when triggered
- Log: only logs the packet when triggered
- Pass: ignores or drops the packet
- Activate: alerts and then activates a dynamic rule/rules
- Dynamic: ignores until started by an activate rule, then acts as a log rule
- Rule protocols:
- TCP
- UDP
- IP
- ICMP
- Possible protocols in the future: ARP, IGRP, GRE, OSPF, RIP
Testing Your Rule
- To test your rule, you need to:
- Configure your VM with a NAT network setup
- Start Snort on your VM using the following command:
sudo snort -A console -c snort.conf - Open another terminal window and send a ping call to test the rule
- Verify that the rule worked by checking the console in the other window
Snort Rule Syntax
- Every rule requires at a minimum the "sid" option
- It is also good practice to include a unique message describing what the rule has detected, "msg" option
- When a rule is positive, the message is logged
TCP Rules
- TCP rules can alert or log connection-oriented communications between a source and destination
- You can check the flag that is being sent with the packet
- You do not need to check the flag, but you will alert/log every transaction between the source and host if you do not specify the flag
UDP Rules
- UDP rules can alert or log connectionless communications between a source and destination
- You can specify the content of the packet to filter out false positives
Non-Filtering Rule Options
- Revision: used to mark the version of the rule
- Nocase: removes case sensitivity for uricontent and content options
- Session: allows the TCP session information to be captured
- Stateless: changes when the alert is made, watching a TCP session and sending an alert once the session is completed### Flex Response
- Flex Response is a plugin that allows Snort to act as a session interception IPS
- Requires building Snort from source with the flexresp plugin
- Allows Snort to send a reset packet to the sender, recipient, or both parties
- Keywords: rst_snd, rst_rcv, rst_all, icmp_net, icmp_host, icmp_port, icmp_all
React Response
- The React response option is useful when blocking attacks that use the TCP session
- Does not require compiling Snort from source
- Only works on TCP protocol rules
- Keywords: block, warn, msg, proxy
Snort Inline and SnortSAM
- Snort Inline adds new functionality to Snort, including two new actions and a new rule option
- The two new actions are drop and sdrop, which allow Snort to drop offending packets
- The new rule option is replace, which allows Snort to change the content of a packet
- SnortSAM is a program that runs alongside Snort to provide IPS-like actions
- SnortSAM requires patching Snort to provide a different output module
Intrusion Prevention Strategies
- Host-based memory and process protection
- Session Interception
- Gateway intrusion detection
- Intrusion Prevention Risks: Session interception IPS identification, Exploit beating the attempted block, Self-inflicted Denial of service
Tuning Snort
- Tailor the decoder and preprocessors
- Use the no_alerts option to remove unnecessary data
- Tune individual rules to be as specific as possible
- Use thresholding to limit the number of alerts produced by a single rule
- Pass rules are used to remove false positives, but should not be used in favor of thresholding
Decoder Configurations
- There are six decoder configurations in the snort.conf file
- These configurations disable alerts on certain rules
- Should be commented out when developing rules and verified when active
- Located under step 2 of the snort.conf file
Preprocessors
- Flow preprocessor provides service to the flow-portscan preprocessor
- Frag 3 preprocessor is used for fragment reassembly
- Http_inspector preprocessor provides valuable information, but can generate a lot of noise
Studying That Suits You
Use AI to generate personalized quizzes and flashcards to suit your learning preferences.
Description
Learn how to effectively deploy Snort as a Network Intrusion Detection System (NIDS) and configure the snort.conf file to ensure optimal performance. Understand the essential components required for successful Snort deployment. Quiz yourself on Snort setup and configuration.
