Snort for Network IDS

What is Snort?

Snort is an open source network intrusion detection system (NIDS) that can audit network traffic in real-time. Snort is a packet sniffer, a packet logger, and a network intrusion detection system.

Snort as I mentioned before is an open source software which means it can be configured and complied on most operating systems. Snort has been ported over to Microsoft Windows operating systems also, but it's bread and butter is back on the UNIX/Linux side of the house. Most Linux distributions now include Snort as part of their install package, and though it may not be enabled by default, normally it is on the installation CD's or DVD's.

Should I run Snort if I have a firewall?

I believe that yes you should run a NDIS even with a firewall. Firewalls help to block packets coming in to your system, however if you are running different servers or services that require the firewall to let them through you are letting a large amount of data go un-audited. Snort has the ability to see trends in incoming data and identify them as a threat and take appropriate action on your system. Snort gives you the ability to see if you are being port scanned, or to see if someone is trying to abuse well known backdoors or problems in well known daemons. Running services and applications that help you to protect your system is always a good idea. Many system administrators run a firewall, snort, and a data file integrity checker (often Tripwire).

How does snort actually work?

Snort generally is running as a background application and it is constantly packet sniffing all the information passing through your network interface card (NIC). The data is then sorted by various preprocessors that basically sort the packet data in to different categories. Once the data has been sorted out it is run through the rules, or the detection phase. As Snort detects trends in the data it applies the rules and actions them appropriately. The final stages are logging the rule infractions and if configured alerting the system administration team in real-time as the infraction occurs.

Is Snort difficult to configure and use?

Snort, as mentioned before now often comes bundled or available through rpm's in most Linux distributions. The hard part of running snort is if you decide to create your own original rules which can get extremely complex. However, luckily for us you can download up to date rule sets for free off the Snort website (you must signup for the free registration).

For extra ease of use there are many different applications and log parsers which have been designed to work with Snort. These applications can create websites based on the data Snort has logged or help you identify trends or possibly security threats on your system.

Ken Dennis
http://KenDennis-RSS.homeip.net/

---

Fleet Maintenance Software Reviews

Innovative Maintenance Systems (IMS) is one company that offers solutions... Read More

What to Do if All Screensavers Fun is Grayed Out?

Finally, you have some time to personalize your desktop with... Read More

IT Strategy for Midsize Business: Microsoft vs. Java, Great Plains & CRM

Midsize business or non-profit organization should decide if one-vendor solution... Read More

The Death of Windows

I have always regretted how Microsoft price gouges and rips... Read More

How To Avoid Getting Hooked By Pfishing

"Pfishing", sometimes spelled "Phishing", is a word that's used to... Read More

Corporate ERP Selection: Microsoft Great Plains

In our opinion, traditional approach when you select ERP/MRP system... Read More

QuarkXpress Tips: How to Move Content Between Print and Web Layouts

Since its release in 1987, QuarkXpress had made an immediate... Read More

Chinese Input - Step by Step Instruction on How to Input Chinese Characters in English Windows XP

Enabling Chinese input is quick and easy, there are only... Read More

Assertion in Java

Assertion facility is added in J2SE 1.4. In order to... Read More

A Time-Saving Programming Tactic that Doesn?t Work

Let's say that you have a software project that's under... Read More

Microsoft CRM and No-Frills Cadillacs

In today's business world it's all but impossible to escape... Read More

Microsoft Business Solutions Customization Options - Overview for Programmer

Several years ago Microsoft purchased Great Plains Software, then Navision... Read More

Windows Screensavers Explained

In this article you will find some background information about... Read More

Reloading Windows XP

If you have been running Windows XP for a couple... Read More

Microsoft CRM and Great Plains Implementation: Freight Forwarding Business Automation Example

Microsoft Business Solutions offers several ERP applications: Great Plains, Navision,... Read More

Marketing Your WinRunner Team

It won't matter how effective your WinRunner Team is if... Read More

Microsoft Great Plains Integration Manager: Using Continuum ? Overview for Developer

Microsoft Business Solutions Great Plains has I'd say end user... Read More

FreeDOS

Before September 1995, Microsoft Windows was an MS-DOS program. DOS... Read More

Dig Out That Worm

Internet worms. Is your PC infected?If your computer has become... Read More

Microsoft CRM Implementation & Remote Support

We would like to give you pluses and minuses of... Read More

Adware, What Is It?

Adware is a type of Spyware program that displays some... Read More

Understanding XML Server

XML Server can be a Web Server that stores the... Read More

Most Dangerous Types of Spyware are on the Rise: How to Choose the Weapon

Bad News - the Threat is Bigger than it SeemedHow... Read More

Internet Faxing Service Review

The Internet is reshaping every form of communications medium, and... Read More

Microsoft Great Plains e-Commerce ? additional considerations for programmer

Microsoft Great Plains, designed back in 1990th as database transferable... Read More

Oracle Development: JDeveloper 10G ? Java, J2EE, EJB, MVC, XML - Overview For Programmer

In 2004 Oracle, Inc. made its new step toward J2EE... Read More

Microsoft CRM Customization Secrets ? Second Edition

This article is for advanced Microsoft CRM SDK C# developers.... Read More

Top Questions to Ask Before Buying a Help Desk & Asset Management Software

#5 All your hardware components like Printers, PCs etc come... Read More

HSphere Control Panel Tips and Tricks - Power At Your Fingertips: Part 1

The first topic we are going to discuss... Read More

Microsoft Business Solutions Products Selection: ERP, CRM, Retail Management

Let's first look at your ERP system selection (without Retail... Read More

C++ Tutorial 1, Introduction to C++

Introduction to C++Why Learn C++?C++ may at first seem like... Read More

5 Time-Saving Tips in Microsoft Word

Whether you have used Microsoft Word for years, have just... Read More

How To Develop Software For Your Business

Software development is a risky business.Many software developers are barely... Read More