[Snort-users] another question

Shafer, Troy tshafer at ...7761...
Mon Dec 16 11:58:03 EST 2002


I found this code on the net for logging aim traffic...

alert tcp any any -> any 5190 (msg:"AIM Message"; content:"HTML";)

my first question, does this actually log the content of the messages and
two how would I implement this with snort... write a .rules file... then put
and include in the the snort.conf?  Still trying to figure this snort thing
out...

Troy Shafer
Network Engineer
Laurel County Schools
 
606-862-4616
tshafer at ...7761...

-----Original Message-----
From: snort-users-request at lists.sourceforge.net
[mailto:snort-users-request at lists.sourceforge.net] 
Sent: Monday, December 16, 2002 1:49 PM
To: snort-users at lists.sourceforge.net
Subject: Snort-users digest, Vol 1 #2587 - 8 msgs

Send Snort-users mailing list submissions to
	snort-users at lists.sourceforge.net

To subscribe or unsubscribe via the World Wide Web, visit
	https://lists.sourceforge.net/lists/listinfo/snort-users
or, via email, send a message with subject or body 'help' to
	snort-users-request at lists.sourceforge.net

You can reach the person managing the list at
	snort-users-admin at lists.sourceforge.net

When replying, please edit your Subject line so it is more specific
than "Re: Contents of Snort-users digest..."


Today's Topics:

   1. Re: Exclude IP addresses for all rules (Jens Krabbenhoeft)
   2. writing to DB (only!) (Eduard San Anselmo Mateu)
   3. RE: DB ERROR (Luo, Philip)
   4. Ignorehosts, once again (Marc Quibell)
   5. Newbie (Shafer, Troy)
   6. Update (=?iso-8859-1?q?Luiz=20Alberto=20Cataldo=20Jr?=)
   7. Re: Snort-users digest, Vol 1 #2581 - 7 msgs (Robert Young)
   8. RE: New Trend: Intrusion Prevention (Sheahan, Paul (PCLN-NW))

--__--__--

Message: 1
Date:	Mon, 16 Dec 2002 09:11:15 +0100
From:	Jens Krabbenhoeft <tschenz-snort-users at ...7018...>
To:	snort-users at lists.sourceforge.net
Subject: Re: [Snort-users] Exclude IP addresses for all rules

Hi,

> I want to exclude IP addresses in my home net from being watched at
> all.

As you write 'being watched at all' the best thing to do is to ignore
the IPs via BPF. Have a look at Erek Adams post:

http://marc.theaimsgroup.com/?l=snort-users&m=102347618314311&w=2

Try starting snort with "snort -options.... not host 192.168.1.1 and not
host 192.168.1.2".

> var HOME_NET [!$EXCLUDE,192.168.1.0/24]

The problem is, that you have an ORed list in HOME_NET. !192.168.1.1 OR
192.168.1.0/24 matches on all IPs in 192.168.1.0/24.

Have a look at my last week's post at
http://marc.theaimsgroup.com/?l=snort-users&m=103942066423750&w=2

HTH,
	Jens


--__--__--

Message: 2
Date: Mon, 16 Dec 2002 12:04:29 +0100
From: Eduard San Anselmo Mateu <esananselmo at ...6002...>
To: snort-users at lists.sourceforge.net
Subject: [Snort-users] writing to DB (only!)

Hi everyone,
I think I can't get to understand the way snort stores information, i.e.
output
plugins. The thing is that I would like snort to only store information in
the
database (so I set the database output plugin with log(?)...), but I don't
want
any information being written to a file (so I put -A none on the command
line,
is it right?). Of course, the output database plugin is the only one I have
uncommented at the conf file, so snort should only log to the database, but
I
get the message "WARNING: command line overrides rules file alert plugin",
and
I've read that snort won't log to the database when this message shows up.
So what am I doing wrong? Could anyone point me to a doc where output
plugins
are explained?
Thanks in advance.
Eduard



--__--__--

Message: 3
From: "Luo, Philip" <Philip_Luo at ...4729...>
To: 'Steve Suehring' <snort at ...7160...>
Cc: snort-users at lists.sourceforge.net
Subject: RE: [Snort-users] DB ERROR
Date: Mon, 16 Dec 2002 08:43:07 -0500

There is no error when I tried mysql -u snort -p snort,
Then I tried the rest, here is what I got,

mysql> show grants for snort at ...274...;
+---------------------------------------------------------------------------
----
-----------------------------------------------------+
| Grants for snort at ...274...
                                                     |
+---------------------------------------------------------------------------
----
-----------------------------------------------------+
| GRANT SHOW DATABASES, CREATE TEMPORARY TABLES, LOCK TABLES ON *.* TO
'snort'@'
localhost' IDENTIFIED BY PASSWORD '1e6b29186dd45e97' |
| GRANT SELECT, INSERT, DELETE, CREATE ON `snort`.* TO 'snort'@'localhost'
                                                     |
+---------------------------------------------------------------------------
----
-----------------------------------------------------+
2 rows in set (0.00 sec)

mysql> show grants for snort at ...263...;
+---------------------------------------------------------------------------
----
-----------------------------------------------------+
| Grants for snort at ...263...
                                                     |
+---------------------------------------------------------------------------
----
-----------------------------------------------------+
| GRANT SHOW DATABASES, CREATE TEMPORARY TABLES, LOCK TABLES ON *.* TO
'snort'@'
127.0.0.1' IDENTIFIED BY PASSWORD '1e6b29186dd45e97' |
| GRANT SELECT, INSERT, DELETE, CREATE ON `snort`.* TO 'snort'@'127.0.0.1'
                                                     |
+---------------------------------------------------------------------------
----
-----------------------------------------------------+
2 rows in set (0.00 sec)


-----Original Message-----
From: Steve Suehring [mailto:snort at ...7160...] 
Sent: Friday, December 13, 2002 10:13 AM
To: Luo, Philip
Cc: snort-users at lists.sourceforge.net
Subject: Re: [Snort-users] DB ERROR

Can you try doing something like this from the command-line:

mysql -u snort -p snort

Then see what error and/or error number you get.

Also, from with the MySQL CLI (as root):
show grants for snort at ...274...;
show grants for snort at ...263...;

Steve

On Fri, Dec 13, 2002 at 09:20:46AM -0500, Luo, Philip wrote:
> I did, no luck. I modifies the hosts file too.
> 
> -----Original Message-----
> From: Jens Krabbenhoeft [mailto:tschenz-snort-users at ...7018...] 
> Sent: Thursday, December 12, 2002 11:36 AM
> To: snort-users at lists.sourceforge.net
> Subject: Re: [Snort-users] DB ERROR
> 
> Hi,
> 
> > grant INSERT,SELECT,CREATE,DELETE on snort.* to snort at ...274...
identified
>                                                         ^^^^^^^^^
> > Database ERROR:Database ERROR:Access denied for user: 'snort at ...263...'
to
>                                                                ^^^^^^^^^
> 
> Try doing a grant for snort at ...263...
> 
> HTH,
> 	Jens 
> 
> 
> -------------------------------------------------------
> This sf.net email is sponsored by:
> With Great Power, Comes Great Responsibility 
> Learn to use your power at OSDN's High Performance Computing Channel
> http://hpc.devchannel.org/
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users
> 
> 
> 
> -------------------------------------------------------
> This sf.net email is sponsored by:
> With Great Power, Comes Great Responsibility 
> Learn to use your power at OSDN's High Performance Computing Channel
> http://hpc.devchannel.org/
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users



--__--__--

Message: 4
From: "Marc Quibell" <mquibell at ...7759...>
To: snort-users at lists.sourceforge.net
Date: Mon, 16 Dec 2002 08:29:32 -0600
Subject: [Snort-users] Ignorehosts, once again



OK, got another implementation of SNort. Now I forgot how I got it to ignore
certain SOURCE IPs (such as using the DNS_SERVERS variable. I know there is
a
syntax issue with this. WHat is the exact way to ignore a host source?

I currently have:
var DNS_SERVERS [207.108.40.###,207.108.40.###]
preprocessor portscan-ignorehosts: $DNS_SERVERS

THis does not work. I've seen several variations, none of which work: It
still
gets alerts from these hosts.

TIA

Marc




--__--__--

Message: 5
From: "Shafer, Troy" <tshafer at ...7761...>
To: "'snort-users at lists.sourceforge.net'"
	 <snort-users at lists.sourceforge.net>
Date: Mon, 16 Dec 2002 10:12:07 -0500
Subject: [Snort-users] Newbie

This message is in MIME format. Since your mail reader does not understand
this format, some or all of this message may not be legible.

------_=_NextPart_001_01C2A515.7F7A8F70
Content-Type: text/plain

Hello, I recently became the network engineer of Laurel County Schools.  As
part of my job, I am trying to implement some security and logging abilities
to the network. We are using Snort 1.9 for Windows.  I have a problem
getting it to run in NDIS... 
 
C:\Snort>snort -c chat.conf -l c:\snort\log
Initializing Output Plugins!
Log directory = c:\snort\log
 
Initializing Network Interface \
 
        --== Initializing Snort ==--
Decoding Ethernet on interface \Device\NPF_{A4116FF7-6102-
}
Initializing Preprocessors!
Initializing Plug-ins!
Parsing Rules file chat.conf
 
+++++++++++++++++++++++++++++++++++++++++++++++++++
Initializing rule chains...
ERROR => Undefined variable name: (chat.conf:10): HOME_NET
Fatal Error, Quitting..
 
C:\Snort>
 
Basically I am just trying to load the rules for chat clients and it keeps
giving me this error.  I tried to debug the code, but I am not sure of all
what is going inside the ruleset.  Can anyone help me?
 
Also if I'm sending this to the wrong place I'm sorry.  If there is a more
appropriate place I would appreciate the link.
 
Troy Shafer
Network Engineer
Laurel County Schools
 
606-862-4616
tshafer at ...7761... <mailto:tshafer at ...7761...> 
 

------_=_NextPart_001_01C2A515.7F7A8F70
Content-Type: text/html
Content-Transfer-Encoding: quoted-printable

<html xmlns:o=3D"urn:schemas-microsoft-com:office:office" =
xmlns:w=3D"urn:schemas-microsoft-com:office:word" =
xmlns=3D"http://www.w3.org/TR/REC-html40">

<head>
<META HTTP-EQUIV=3D"Content-Type" CONTENT=3D"text/html; =
charset=3Dus-ascii">


<meta name=3DProgId content=3DWord.Document>
<meta name=3DGenerator content=3D"Microsoft Word 10">
<meta name=3DOriginator content=3D"Microsoft Word 10">
<link rel=3DFile-List href=3D"cid:filelist.xml at ...7762...">
<!--[if gte mso 9]><xml>
 <o:OfficeDocumentSettings>
  <o:DoNotRelyOnCSS/>
 </o:OfficeDocumentSettings>
</xml><![endif]--><!--[if gte mso 9]><xml>
 <w:WordDocument>
  <w:SpellingState>Clean</w:SpellingState>
  <w:GrammarState>Clean</w:GrammarState>
  <w:DocumentKind>DocumentEmail</w:DocumentKind>
  <w:EnvelopeVis/>
  <w:Compatibility>
   <w:BreakWrappedTables/>
   <w:SnapToGridInCell/>
   <w:WrapTextWithPunct/>
   <w:UseAsianBreakRules/>
  </w:Compatibility>
  <w:BrowserLevel>MicrosoftInternetExplorer4</w:BrowserLevel>
 </w:WordDocument>
</xml><![endif]-->
<style>
<!--
 /* Style Definitions */
 p.MsoNormal, li.MsoNormal, div.MsoNormal
	{mso-style-parent:"";
	margin:0in;
	margin-bottom:.0001pt;
	mso-pagination:widow-orphan;
	font-size:12.0pt;
	font-family:"Times New Roman";
	mso-fareast-font-family:"Times New Roman";}
a:link, span.MsoHyperlink
	{color:blue;
	text-decoration:underline;
	text-underline:single;}
a:visited, span.MsoHyperlinkFollowed
	{color:purple;
	text-decoration:underline;
	text-underline:single;}
span.EmailStyle17
	{mso-style-type:personal-compose;
	mso-style-noshow:yes;
	mso-ansi-font-size:10.0pt;
	mso-bidi-font-size:10.0pt;
	font-family:Arial;
	mso-ascii-font-family:Arial;
	mso-hansi-font-family:Arial;
	mso-bidi-font-family:Arial;
	color:windowtext;}
span.SpellE
	{mso-style-name:"";
	mso-spl-e:yes;}
span.GramE
	{mso-style-name:"";
	mso-gram-e:yes;}
@page Section1
	{size:8.5in 11.0in;
	margin:1.0in 1.25in 1.0in 1.25in;
	mso-header-margin:.5in;
	mso-footer-margin:.5in;
	mso-paper-source:0;}
div.Section1
	{page:Section1;}
-->
</style>
<!--[if gte mso 10]>
<style>
 /* Style Definitions */=20
 table.MsoNormalTable
	{mso-style-name:"Table Normal";
	mso-tstyle-rowband-size:0;
	mso-tstyle-colband-size:0;
	mso-style-noshow:yes;
	mso-style-parent:"";
	mso-padding-alt:0in 5.4pt 0in 5.4pt;
	mso-para-margin:0in;
	mso-para-margin-bottom:.0001pt;
	mso-pagination:widow-orphan;
	font-size:10.0pt;
	font-family:"Times New Roman";}
</style>
<![endif]-->
</head>

<body lang=3DEN-US link=3Dblue vlink=3Dpurple =
style=3D'tab-interval:.5in'>

<div class=3DSection1>

<p class=3DMsoNormal><font size=3D2 face=3DArial><span =
style=3D'font-size:10.0pt;
font-family:Arial'>Hello, I recently became the network engineer of =
Laurel
County Schools.<span style=3D'mso-spacerun:yes'>  </span>As part =
of my job,
I am trying to implement some security and logging abilities to the =
network. We
are using Snort 1.9 for Windows.<span style=3D'mso-spacerun:yes'>  =
</span>I
have a problem getting it to run in NDIS... =
<o:p></o:p></span></font></p>

<p class=3DMsoNormal><font size=3D2 face=3DArial><span =
style=3D'font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>

<p class=3DMsoNormal><font size=3D2 face=3DArial><span =
style=3D'font-size:10.0pt;
font-family:Arial'>C:\Snort>snort -c <span =
class=3DSpellE>chat.conf</span> -l
c:\snort\log<o:p></o:p></span></font></p>

<p class=3DMsoNormal><font size=3D2 face=3DArial><span =
style=3D'font-size:10.0pt;
font-family:Arial'>Initializing Output <span =
class=3DSpellE>Plugins</span>!<o:p></o:p></span></font></p>

<p class=3DMsoNormal><font size=3D2 face=3DArial><span =
style=3D'font-size:10.0pt;
font-family:Arial'>Log directory =3D =
c:\snort\log<o:p></o:p></span></font></p>

<p class=3DMsoNormal><font size=3D2 face=3DArial><span =
style=3D'font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>

<p class=3DMsoNormal><font size=3D2 face=3DArial><span =
style=3D'font-size:10.0pt;
font-family:Arial'>Initializing Network Interface =
\<o:p></o:p></span></font></p>

<p class=3DMsoNormal><font size=3D2 face=3DArial><span =
style=3D'font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>

<p class=3DMsoNormal><font size=3D2 face=3DArial><span =
style=3D'font-size:10.0pt;
font-family:Arial'><span
style=3D'mso-spacerun:yes'>        =
</span>--=3D=3D
Initializing Snort =3D=3D--<o:p></o:p></span></font></p>

<p class=3DMsoNormal><font size=3D2 face=3DArial><span =
style=3D'font-size:10.0pt;
font-family:Arial'>Decoding Ethernet on interface =
\Device\NPF_{A4116FF7-6102-<o:p></o:p></span></font></p>

<p class=3DMsoNormal><font size=3D2 face=3DArial><span =
style=3D'font-size:10.0pt;
font-family:Arial'>}<o:p></o:p></span></font></p>

<p class=3DMsoNormal><font size=3D2 face=3DArial><span =
style=3D'font-size:10.0pt;
font-family:Arial'>Initializing =
Preprocessors!<o:p></o:p></span></font></p>

<p class=3DMsoNormal><font size=3D2 face=3DArial><span =
style=3D'font-size:10.0pt;
font-family:Arial'>Initializing Plug-ins!<o:p></o:p></span></font></p>

<p class=3DMsoNormal><font size=3D2 face=3DArial><span =
style=3D'font-size:10.0pt;
font-family:Arial'>Parsing Rules file <span =
class=3DSpellE>chat.conf</span><o:p></o:p></span></font></p>

<p class=3DMsoNormal><font size=3D2 face=3DArial><span =
style=3D'font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>

<p class=3DMsoNormal><font size=3D2 face=3DArial><span =
style=3D'font-size:10.0pt;
font-family:Arial'>+++++++++++++++++++++++++++++++++++++++++++++++++++<o=
:p></o:p></span></font></p>

<p class=3DMsoNormal><font size=3D2 face=3DArial><span =
style=3D'font-size:10.0pt;
font-family:Arial'>Initializing rule =
chains...<o:p></o:p></span></font></p>

<p class=3DMsoNormal><font size=3D2 face=3DArial><span =
style=3D'font-size:10.0pt;
font-family:Arial'>ERROR =3D> Undefined variable name: =
(chat.conf:10):
HOME_NET<o:p></o:p></span></font></p>

<p class=3DMsoNormal><font size=3D2 face=3DArial><span =
style=3D'font-size:10.0pt;
font-family:Arial'>Fatal Error, Quitting<span =
class=3DGramE>..</span><o:p></o:p></span></font></p>

<p class=3DMsoNormal><font size=3D2 face=3DArial><span =
style=3D'font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>

<p class=3DMsoNormal><font size=3D2 face=3DArial><span =
style=3D'font-size:10.0pt;
font-family:Arial'>C:\Snort><o:p></o:p></span></font></p>

<p class=3DMsoNormal><font size=3D2 face=3DArial><span =
style=3D'font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>

<p class=3DMsoNormal><font size=3D2 face=3DArial><span =
style=3D'font-size:10.0pt;
font-family:Arial'>Basically I am just trying to load the rules for =
chat
clients and it keeps giving me this error.<span =
style=3D'mso-spacerun:yes'> 
</span>I tried to debug the code, but I am not sure of all what is =
going inside
the <span class=3DSpellE>ruleset</span>.<span =
style=3D'mso-spacerun:yes'> 
</span>Can anyone help me?<o:p></o:p></span></font></p>

<p class=3DMsoNormal><font size=3D2 face=3DArial><span =
style=3D'font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>

<p class=3DMsoNormal><font size=3D2 face=3DArial><span =
style=3D'font-size:10.0pt;
font-family:Arial'>Also if I'm sending this to the wrong place I'm
sorry.<span style=3D'mso-spacerun:yes'>  </span>If there is a more
appropriate place I would appreciate the =
link.<o:p></o:p></span></font></p>

<p class=3DMsoNormal><font size=3D2 face=3DArial><span =
style=3D'font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>

<p class=3DMsoNormal><strong><b><font size=3D4 color=3Dnavy =
face=3DArial><span
style=3D'font-size:13.5pt;font-family:Arial;color:navy;mso-no-proof:yes'=
>Troy
Shafer</span></font></b></strong><span =
style=3D'mso-no-proof:yes'><o:p></o:p></span></p>

<p class=3DMsoNormal><font size=3D3 color=3Dnavy face=3DArial><span =
style=3D'font-size:
12.0pt;font-family:Arial;color:navy;mso-no-proof:yes'>Network =
Engineer</span></font><span
style=3D'mso-no-proof:yes'><o:p></o:p></span></p>

<p class=3DMsoNormal><font size=3D3 color=3Dnavy face=3DArial><span =
style=3D'font-size:
12.0pt;font-family:Arial;color:navy;mso-no-proof:yes'>Laurel County =
Schools</span></font><span
style=3D'mso-no-proof:yes'><o:p></o:p></span></p>

<p class=3DMsoNormal><font size=3D3 face=3D"Times New Roman"><span =
style=3D'font-size:
12.0pt;mso-no-proof:yes'> <o:p></o:p></span></font></p>

<p class=3DMsoNormal><font size=3D2 color=3Dnavy face=3DArial><span =
style=3D'font-size:
10.0pt;font-family:Arial;color:navy;mso-no-proof:yes'>606-862-4616</span=
></font><span
style=3D'mso-no-proof:yes'><o:p></o:p></span></p>

<p class=3DMsoNormal><font size=3D2 color=3Dnavy face=3DArial><span =
style=3D'font-size:
10.0pt;font-family:Arial;color:navy;mso-no-proof:yes'><a
href=3D"mailto:tshafer at ...7761...">tshafer at ...7761...</a></s=
pan></font><o:p></o:p></p>

<p class=3DMsoNormal><font size=3D3 face=3D"Times New Roman"><span =
style=3D'font-size:
12.0pt'><o:p> </o:p></span></font></p>

</div>

</body>

</html>

------_=_NextPart_001_01C2A515.7F7A8F70--


--__--__--

Message: 6
Date: Mon, 16 Dec 2002 13:23:10 -0300 (ART)
From: =?iso-8859-1?q?Luiz=20Alberto=20Cataldo=20Jr?=
<cataldo_jr at ...6873...>
To: Snort Lista <snort at ...1601...>,
  Snort List <snort-users at lists.sourceforge.net>
Subject: [Snort-users] Update

--0-1253038778-1040055790=:55614
Content-Type: text/plain; charset=iso-8859-1
Content-Transfer-Encoding: 8bit


Hi guys, how can I make to configure the automatic update of the Snort ?

Thanks,

Luiz



---------------------------------
Busca Yahoo! 
O melhor lugar para encontrar tudo o que você procura na Internet
--0-1253038778-1040055790=:55614
Content-Type: text/html; charset=iso-8859-1
Content-Transfer-Encoding: 8bit

<P>Hi guys, how can I make to configure the automatic update of
the Snort ?</P>
<P>Thanks,</P>
<P>Luiz</P><p><br><hr size=1><b><a href="http://br.busca.yahoo.com/">Busca
Yahoo! </a></b><br>
O melhor lugar para encontrar tudo o que você procura na Internet
--0-1253038778-1040055790=:55614--


--__--__--

Message: 7
Date: Mon, 16 Dec 2002 10:01:09 -0800
From: Robert Young <kwailoe at ...634...>
To: snort-users at lists.sourceforge.net
Subject: [Snort-users] Re: Snort-users digest, Vol 1 #2581 - 7 msgs

You wrote:

Message: 1
From: "Don" <Don at ...5881...>
To: <snort-users at lists.sourceforge.net>
Date: Fri, 13 Dec 2002 10:54:14 -0800
Subject: [Snort-users] stopping snort

Has anyone found a way to stop snort, automatically, what i want to do is
have snort stop, if it gets more than 'x' alerts in a single hour, or some
time frame, then of course email me that it has stopped. i do go to syslog
with alerts. any suggestions. I have a particular sensor that periodically
starts alerting on something, that just causes a round robin effect, and
fills up the logs with the same error over and over and over, it gets really
boring actually. 'if' i can open the log. the logs have became as large as
2gig on occasion.

#!/bin/sh
# Robert Young
# start and stop snort IDS
# chkconfig:  345 85 15
#     Starts and stops snort -swiped from init.d
# processname: snort
# pidfile: /var/run/IDS.pid

# Source function library
 .   /etc/rc.d/init.d/functions

# See how we were called
case "$1" in
 start)
    echo -n "Starting IDS: "
/usr/local/snort -A full -D -c /etc/rules/snort.conf
    echo
    touch /var/lock/susbsys/IDS
    pidof snort > /var/run/IDS.pid
    ;;
 stop)
    echo -n " Shutting down IDS: "
    [ -f /var/run/IDS.pid ]  && {
        kill -9 `cat .var/run/IDS.pid`
        exho -n IDS

    }
    echo
    rm -f /var/lock/susbsys/IDS
    rm -f /var/run/IDS.pid
    ;;
 status)
            status IDS
            ;;
 restart)
            $0 stop
            $0 start
            ;;
*)
            echo "Usage: {start | stop | restart | status}"
            exit 1
esac
exit 0

make the script executable and place it in /etc/rc.d/init.d.   You may  be
able to write a script that reacts to certain conditions.  for example I
have used swatch to monitor my alert logs and page me when it detects
hostile traffic exiting my network.  swatch can excute the above script as
well.  You  will need to edit the obvious commands to fit
your set up.

This has worked with red hat 7.3

Bob Young



--__--__--

Message: 8
From: "Sheahan, Paul (PCLN-NW)" <Paul.Sheahan at ...2218...>
To: "'Martin Roesch'" <roesch at ...1935...>
Cc: "Snort List (E-mail)" <snort-users at lists.sourceforge.net>
Subject: RE: [Snort-users] New Trend: Intrusion Prevention
Date: Mon, 16 Dec 2002 13:48:33 -0500

Hi Marty,

Thanks for the feedback. I totally agree with your view on this. I
definitely don't see IPS replacing IDS myself either. I can see IPS
complementing IDS but that's about it.

Giga Research was at Infosec 2002 in New York and they and others mentioned
several times when speaking about security trends that IDS will be replaced
by IPS. They even went as far as to say if you haven't started a corporate
IDS installation at your company, to hold off and look at IPS. See their
website where they have articles speaking about this (www.gigaweb.com).

Another interesting speech at Infosec 2002 by Counterpane's Bruce Schneier
also backs up our view on this issue. He stated several times that
prevention is always the preferred security method over detection, BUT,
prevention will ALWAYS fail at some point, so detection will always be
needed as a backup.


Paul Sheahan
Manager of Information Security
Priceline.com
paul.sheahan at ...2218...



-----Original Message-----
From: Martin Roesch [mailto:roesch at ...1935...]
Sent: Friday, December 13, 2002 5:21 PM
To: Sheahan, Paul (PCLN-NW)
Cc: Snort List (E-mail)
Subject: Re: [Snort-users] New Trend: Intrusion Prevention


Hi Paul,

I went into this on the Focus-IDS mailing list a month or so ago.  
Basically, I believe IPS to be more of a threat to (or the future of) 
firewalls.  Network intrusion prevention devices sit in-line and 
provide permit/deny access control for packet streams based on whether 
or not they're attacks.  Presumably it would be relatively easy as a 
subset of functionality to add stateful packet filtering that's just as 
good or better than any existing firewalling mechanisms.  Netscreen and 
Checkpoint have figured this out which is why you see them making 
aggressive moves in the IPS space.  Intrusion detection devices have a 
VERY different role in the network security hierarchy, they provide 
*awareness* of what's happening on your network, verification of policy 
compliance and detection of potential threats and anomalies.

Let me lay out two scenarios that illustrate why intrusion prevention 
!= intrusion detection and why it's unlikely that IPS will ever replace 
IDS (and how everyone who's trying to tell you it will is trying to 
sell you something):

1) IPS devices only guard the peering points (at best) of the network.  
In the case of an attack between hosts on the same broadcast network 
(inside the peering point) you have absolutely no coverage from the 
IPS.  In that case you'll need to have an IDS to tell you what's going 
on.  For example, someone in engineering decides to give him self a 
raise by hacking into the accounting department and making it so, your 
IPS has no visibility into this traffic so it's quite worthless.  Your 
IDS can see this traffic, however, and collect the relevant information 
for detection/enforcement of policy and evidence for law enforcement.

2) No IPS is going to be perfect, so attacks are going to slip through 
them.  It can be attacks that they don't know about (new buffer 
overflows, etc) or even traffic that's legitimate but hostile in your 
environment, like non-anonymous logins to your anonymous FTP server.  
If an attack gets by an IDS, how will you know?  You better have a 
pretty good IDS to tell you, that's how.

There are several other things I could highlight, but I think this 
illustrates the point pretty well and it's Friday and late and I feel 
like going home. :)

      -Marty


On Friday, December 13, 2002, at 12:30 PM, Sheahan, Paul (PCLN-NW) 
wrote:

>
> I attended Infosecurity 2002 yesterday and there was much talk about
> intrusion detection going away, and intrusion prevention replacing it. 
> Does
> anyone know if there are any plans to include intrusion prevention
> functionality into Snort in the future?
>
> Thanks,
>
> Paul Sheahan
> Manager of Information Security
> Priceline.com
> paul.sheahan at ...2218...
>
>
>
>
> -------------------------------------------------------
> This sf.net email is sponsored by:
> With Great Power, Comes Great Responsibility
> Learn to use your power at OSDN's High Performance Computing Channel
> http://hpc.devchannel.org/
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users
>
>
-- 
Martin Roesch - Founder/CTO, Sourcefire Inc. - (410)290-1616
Sourcefire: Snort-based Enterprise Intrusion Detection Infrastructure
roesch at ...1935... - http://www.sourcefire.com
Snort: Open Source Network IDS - http://www.snort.org



--__--__--

_______________________________________________
Snort-users mailing list
Snort-users at lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-users


End of Snort-users Digest




More information about the Snort-users mailing list