Snort Tutorial: How to use Snort intrusion detection resources

HOW TO USE SNORT: FEATURES AND CAPABILITIES

Here we will discuss Snort basics and how to use the intrusion detection tool. We will also cover Snort features, including their limitations and capabilities, as well as tips on Snort Stream5, output options and overlapping fragment detection.

Snort limitations and capabilities
(see link below)
Snort has a vast array of both benefits and drawbacks. Running the network inspection and control system in active and passive mode, for example, has security implications.

In this tip, Richard Bejtlich discusses how to use Snort while keeping the restrictions of the intrusion detection tool in mind.

Snort's Stream5 and TCP overlapping fragments
(see link below)
Stream5 is a critical aspect of the Snort IDS's inspection and detection equation. It performs based on its specific configuration and thus must be configured correctly.

Here you will learn how Snort detects security events and how Snort Stream5 preprocessor addresses several aspects of network-centric traffic inspection. Security expert Richard Bejtlich also discusses Snort installation best practices, Snort testing best practices and overlapping fragment detection.

Understanding Snort's Unified2 output
(see link below)
Unified output allows Snort to write sets of data to a sensor's hard drive. Writing to the hard drive, instead of performing database inserts, allows Snort to operate faster and minimize packet loss.

In this edition of the Snort Report, learn how using Snort's source code can help solution providers understand Snort's Unified2 output.

Output options for Snort data
(see link below)
Output modes are the methods by which Snort reports its findings when run in IDS mode. Without output options, VARs cannot produce Snort data in a meaningful manner.

In this tip, intrusion detection expert Richard Bejtlich discusses output options for Snort data and the pros and cons of different features.

When Snort is not enough: Using tools and techniques to support Snort
(see link below
Sometimes Snort is not enough to complete a detection and response operation, making the use of other data-collecting tools and tactics essential.

Learn when and how to support Snort with the use of complementary products and techniques.

Justifying Snort: Communicating the value of Snort
(see link below)
As a value-added reseller (VAR) or security service provider, there's no doubt that you believe Snort and similar tools are valuable. Plenty of IT professionals, however, do not necessarily see intrusion detection systems like Snort as invaluable to their customers and networks.

In this tip, you will learn how to communicate the value of Snort's capabilities to those customers whose IT departments are resistant to the open source tool.

HOW TO TEST SNORT: GUIDELINES AND BEST PRACTICES

In this section of the Snort Tutorial, you will learn how to properly test Snort intrusion detection capabilities to be sure the tool is working properly. This section of the Snort Tutorial will cover several ways to test Snort, set rules and run a variety of verification tools.

Testing Snort: FAQs and common misconceptions
(see link below)
As a value-added reseller or service provider, you may need to test Snort to ensure that the open source IDS detects malicious activity on your client's network or to determine how a custom-written rule will impact Snort's performance.

Here, intrusion detection expert Richard Bejtlich discusses best practices for testing Snort, reviews common misconceptions, and answers several frequently asked questions on testing functions.

How can the operator test Snort?
(see link below)
There are various ways to test Snort's intrusion detection abilities, including setting rules and running tools such as IDSWakeup.

Here you will learn how to test Snort as an operator by figuring out the goal of your Snort test, and then devising the simplest way to achieve that goal.

Using IDS rules to test Snort
(see link below)
Is your new Snort system running too quietly? Whether you're new to using Snort or you've deployed it on a new platform, a low-noise level may have you worried.

This tip highlights several methods for testing Snort over the wire to ensure the tool works properly in your environment.

GUIDELINES FOR WRITING AND MODIFYING SNORT RULES

Snort rules are a powerful aspect of the intrusion detection system. This section of the Snort Tutorial will examine the purpose of the restrictions and discuss best practices for writing and modifying Snort IDS rules.

Best practices for Snort IDS rules
(see link below)
Snort rules are designed to alert an operator to a network event of interest, and they often represent an inference that some sort of malicious activity has occurred on the network.

This tip will help you familiarize yourself with best practices for Snort. Richard Bejtlich also discusses Sourcefire and Bleeding Edge Threats (BET) rules.

Modifying and writing custom Snort IDS rules
(see link below)
Snort rules are powerful, flexible and relatively easy to write. Once you've downloaded existing IDS rules, you can modify them to suit your needs. Here you will learn best practices and guidelines for writing and modifying custom Snort IDS rules.

How to use shared object rules in Snort
(see link below)
Shared object (SO) rules were introduced in Snort 2.6.0 to provide a means to obscure the exact detection mechanism used in the rule and allow for more flexible detection criteria. For the most part, however, organizations have continued to rely upon traditional Snort rules. In this tip, service providers will learn how to get shared object rules working on Snort sensors.

BEST PRACTICES FOR UPGRADING SNORT

This section of the Snort Tutorial is dedicated to Snort upgrades, including the latest version of Snort, Snort 3.0. Here you will learn the capabilities of Snort 3.0 as well as best practices for successfully upgrading to the latest edition.

The power of Snort 3.0
(see link below)
Snort development has taken a new turn with Snort 3.0. Learn about the architecture of Snort 3.0, Snort 3.0 rules language, installation best practices and how service providers will be able to use it to leverage generic network traffic inspection tools.

Snort IDS upgrade and tips on the Snort.conf file
see link below
Here security resellers and consultants will receive expert advice on the productive use of Snort IDS, with details on the Snort 2.6.1.2 upgrade and snort.conf file functions enabled by default -- such as IP ranges, ports of interest and preprocessors.

Snort 3.0: Using SnortSP and Snort 2.8.2
(see link below)
Snort 3.0's basic architecture consists of the Snort Security Platform (SnortSP) and an assortment of other engines. SnortSP is a foundation that provides traffic-inspection functions, like packet acquisition, traffic decoding, flow management and fragment reassembly.

Here you will find out how to run one of the Snort 2.8.2 detection engines on top of SnortSP to maximize the latest version of this open source network intrusion detection system.