Just running snort with rules, as done above, will log only the packets that have signatures that match one of the rules, they will be logged in /var/log/snort. You can also output the alerts to the s

Configuring Snort:

1. 
   Monitor one host
   var HOME_NET 10.1.1.100
   
2. 
   Use the default Ethernet interface’s IP address
   var HOME_NET $eth0_ADDRESS
   
3. 
   Monitor a range of hosts
   var HOME_NET 10.1.1.0/24
   
4. 
   Monitor hosts on different subnets
   var HOME_NET [10.1.1.0/24,192.168.1.0/24]
   

Snort also comes with some interesting support modules. Among them portscan, portscan2, fragmented packet and the stream4 preprocessor stand out. The fragmented packet preprocessor allows snort to reassemble (intentionally) fragmented packets. The portscan and portscan2 preprocessors handle port-scanning techniques. Portscan2 is preferred as it is more general than portscan.

The stream4 preprocessor allows for stateful inspection of TCP traffic. This is important to counter several IDS defeating techniques. Attackers often will send packets out of sequence or retransmit different byte ranges of data in order to evade detection by an IDS. Tools like snot will easily overload Snort with bogus alerts cloaking and attacker’s true attack. Snot is not used in the lab because it needs to be modified to use the newest version of libnet.

Writing Snort Rules:

ACTION PROTOCOL IP[/mask] PORT -> IP[/mask] PORT (OPTIONS)

1. 
   alert - log packet info and alert message to the alert file
   
2. 
   log - log this packet without sending out an alert
   
3. 
   pass – skip matching other rules
   

PROTOCOL

IP

1. 
   A specific address
   10.1.1.101
   
2. 
   A range of addresses using CIDR notation mask
   10.1.1.0/24 or 10.1.0.0/16
   
3. 
   List of comma separated addresses and ranges
   10.1.1.101,192.168.1.0/24
   
4. 
   Any address using the any keyword
   
5. 
   Using the $HOME_NET variable which specifies the home network
   
6. 
   Use an exclamation mark, !, for address (range) negation.
   !10.1.1.101
   

PORT

1. 
   A specific port
   22
   
2. 
   A range of ports
   3000:6000
   
3. 
   Port ranges lower than (example all privileged ports)
   :1024
   
4. 
   Port ranges above (example all non-privileged ports)
   1024:
   
5. 
   Any port using keyword any
   
6. 
   Use an exclamation mark, !, for port (range) negation.
   !22
   

OPTIONS

( option )

( option : option )

Option rules are applied to perform some action or select packet with finer granularity than the generic snort rule. There are a number of protocol specific options, but those will not be covered. Those require more knowledge about the different protocols. You can read about them in the referenced material.

1. 
   Messages to write in the logs or alert files. Messages generally contain the name of the exploit defined by Mitre’s Common Vulnerabilities and Exploits at http://www.cve.mitre.org/, or by CERT’s Advisory Network at http://www.cert.org/advisories/. Good messages also directly link to the exploit definitions.
   

2. 
   Logging to special log files. This allows you to simplify sifting through your log files instead of using on big alert file.
   

3. 
   Packet payload scanning. This technique is used to identify sequences of known patterns in attacks. To improve legibility, snort does not consider white space as part of the rule. Instead rules are written using a combination of ASCII and hex codes. The pipe character, |, is use to identify variable portions of the payload pattern. You may also specify more than one pattern to match. Keep in mind this is an expensive operation. Construct your rules wisely.
   (content: "CONTENT STRING")
   

• 
  Create your own rules file in the rules directory of
  

• 
  Modify //snort-1.9.1/etc/snort.conf
  

• 
  Execute the imapd-ex attack from the attacker box (RH 8.0) again