From the course: Protecting Your Network with Open-Source Software

Unlock the full course today

Join today to access over 24,700 courses taught by industry experts.

Snort as an IDS: Establishing rules

Snort as an IDS: Establishing rules

From the course: Protecting Your Network with Open-Source Software

Start my 1-month free trial Buy for my team

Snort as an IDS: Establishing rules

“

- [Instructor] Let's run Snort as an intrusion detection system. Before we put Snort in its intrusion detection mode, we have to do some prep work. First, we'll introduce a new Snort rule by creating a file. Let's go to /etc/snort/rules/ by typing cd /etc/snort/rules/. Press Enter. We'll create a rule file called my.rules. Type sudo nano my.rules. Press Enter. The new rule we are creating will detect any ping attempts to the interface we want to monitor. Type alert, meaning, whenever there is a ping attempt, send an alert. Space. The next thing to type is a protocol to detect. Ping uses the Internet Control Message Protocol, or ICMP. Therefore, type icmp, We don't care where the ping message is coming from. It could be any IP address or any port number. That's why we type any any in terms of where the packet is coming from. Type -> to indicate the destination. We want to detect every ICMP message. Therefore, the destination IP and the destination port number are any and any too. Next,…

Contents