IDS AND IPS USING SNORT

SNORT INSTALLATION AND CONFIGURATION

Step-1 Install Snort Using  Cmd "sudo apt-get install snort"

Step-2 Install Gedit Using For Editor(You Use Any Editor Like(nano, etc)) Cmd "sudo apt-get install gedit"

Step-3 Go To File/Directory Using This cmd "cd /etc/snort"

Step-4 Create Touch File Using This Cmd "sudo touch snort.back.conf"

Step-5 Create Touch File Using This Cmd "sudo touch test_snort.conf"

Step-6 Copy The File Using This Cmd "sudo cp snort.conf snort.back.conf"

   

Step-7 Copy The File Using This Cmd "sudo cp snort.conf test_snort.conf"

Step-8 Edit The File Using This Cmd "sudo gedit snort.back.conf" ->"HOME_NET IP_Address_Range.(192.168.29.1/Range24)"

Step-9 Edit The File Using This Cmd "sudo gedit test_snort.conf" ->"HOME_NET IP_Address_Range.(192.168.29.1/Range24)"

Step-10 Then Run This Cmd "sudo snort -T -i eth0 -c /etc/snort/test_snort.conf"

Step-11 Then Goto The Folder/Dir Using This Cmd "cd /etc/snort/rules"

Step-12 Then Run This Cmd "sudo nano local.rules"

Edit

alert tcp any any -> $HOME_NET 21 (msg:"ftp connectionn attempt"; sid:1000001; rev:1;)

alert tcp any any -> $HOME_NET 22 (msg:"SSH cnnection attempt"; sid:1000002; rev:1;)

alert tcp any any -> any any (content:"www.facebook.com"; msg:”whoa! Some one Is visiting facebook at this time ”; sid:10000003; rev:1;)

alert tcp any any -> any any (content:"www.youtube.com"; msg:"Youtube alert...."; sid:1000004; rev:1;)

Step-13 Create New Directory Using Run This Cmd "sudo mkdir custom.rules"

Step-14 Create New File Using Run This Cmd "sudo touch custom.rules"

Step-15 In This File Edit The File Using This Cmd "sudo nano custom.rules"

Edit

alert tcp any any -> $HOME_NET 21 (msg:"ftp connectionn attempt"; sid:1000001; rev:1;)

alert tcp any any -> $HOME_NET 22 (msg:"SSH cnnection attempt"; sid:1000002; rev:1;)

alert tcp any any -> any any (content:"www.facebook.com"; msg:”whoa! Some one Is visiting facebook at this time ”; sid:10000003; rev:1;)

alert tcp any any -> any any (content:"www.youtube.com"; msg:"Youtube alert...."; sid:1000004; rev:1;)

       

Step-16 Then Run This Cmd "snort -A console -q -i eth0 -c /etc/snort/test_snort.conf"

Step-17 Run nmap GUI Cmd Prompt 

1)Cmd Prompt Press "(Windows+r)" Type "cmd"

2)Type nmap -T4 -v -A IP Address(192.168.29.1)

In GUI

Open nmap