1. Intrusion Detection Systems • Network Intrusion Detection System – NIDS • Host-based Intrusion Detection System – HIDS • Intrusion Prevention/Protection System – IPS • IDS Service Centers • System Logs

2. Network Intrusion Detection • Open Source NIDS • Snort - www.snort.org • Bro - www.icir.org/vern/bro.html • Commercial NIDS • ISS RealSecure Network Sensor - www.iss.net • Intrusion Inc. SecureNet Sensor- www.intrusion.com • StillSecure Border Guard - www.stillsecure.com

3. Host Intrusion Detection • Open Source HIDS • Samhain – la-samhna.de/samhain • LIDS - www.lids.org • AIDE - www.cs.tut.fi/~rammer/aide.html • Commercial HIDS • Tripwire - www.tripwire.com • eEye Blink - www.eeye.com • Symantec Host IDS - www.symantec.com

4. Intrusion Prevention/Protection • Open Source IPS • Lak-IPS - lak-ips.sourceforge.net • Commercial IPS • ISS Preventia - www.iss.net • ForeScout Active Scout - www.forescout.com • Netscreen IDP - www.netscreen.com • McAfee IntruShield - www.networkassociates.com

5. IDS Service Centers • Mynetwatchman - www.mynetwatchman.com • DShield - www.dshield.org • Internet Storm Center - isc.sans.org

6. System Logs • Firewall logs • Audit logs • System logs • TCP wrappers logs • Web server logs • SMTP server logs • FTP server logs

7. Snort NIDS • Open Source • Home page - www.snort.org • Supports UNIX and Windows • Requires packet capturing library libpcap. • Signature based • Has many frontends and plugins

8. Building Snort • Build libpcap if require. • Obtain source code from www.snort.org. • Unpack source tar ball. • $ ./configure • $ make • $ make install • Binary installs in /usr/loca/bin/snort.

9. Configuring Snort • # adduser -u 6000 -g snort -c “Snort IDS” snort • # cd /home/snort; mkdir etc logs rules • # cp rules/*.rules /home/snort/rules • # cp etc/snort.conf etc/*.config /home/snort/etc • Edit /home/snort/etc/snort.conf. • Create init script for launching snort at boot time. • Schedule log rotation and cleanup.

10. Running Snort • # /usr/local/bin/ntpdate -s -t 10 ntp.alaska.edu • # /sbin/ifconfig eth0 promisc • # /usr/local/bin/snort -u snort -g snort -l /home/snort/logs -d -D -i eth0 -c /home/snort/etc/snort.conf • ps -ax | grep snort • tail /var/log/messages • Setup cron job to synchronize clock.

11. Using Snort • Passive or active detection • Active detection requires beefy machine and port mirroring. • Alerts and portscan logs • Warn sysadmins and security staff. • Alert source ISP. • Trend analysis • What is being exploited. • Data for security reports.

12. Reporting Intrusion Attempts • Required information • Date and Time • Time Zone • Source IP, Port and Protocol • Destination IP and Port • Flags • Packet content containing exploit

13. Whom to Report • Search whois database • whois.arin.net (North America & Academia) • whois.ripe.net (Europe, Middle East & Africa) • whois.apnic.net (Asia Pacific) • whois.krnic.net (South Korea) • whois.nic.ad.jp (Japan) • whois.twnic.net (Taiwan) • whois.lacnic.net (Latin America) • whois.nic.br (Brazil)

14. Questions and Comments • Questions and comments about IDS/IPS • Questions and comments about Snort.