Intrusion detection systems (IDS) provide visibility into malware, unauthorized access attempts, and policy violations targeting an organization‘s infrastructure.
How IDS Differs from IPS
An important distinction exists between IDS and its closely related counterpart, intrusion prevention systems (IPS). While IPS also blocks threats, IDS focuses exclusively on threat detection through traffic monitoring and analysis.
| Intrusion Detection Systems (IDS) | Intrusion Prevention Systems (IPS) |
| – Monitors traffic for malicious patterns | – Detects AND blocks malicious traffic |
| – Alerts administrators of suspicious activity | – Prevents intrusions outright |
| – Maintains visibility even if false positive | – Risks denying legitimate traffic |
Organizations often gain tremendous value deploying IDS and IPS side-by-side to improve prevention while retaining visibility.
Spotlight on Snort – The Leading Open Source IDS
Released in 1998, Snort has grown into the world‘s most widely deployed intrusion detection system. With over 300,000 downloads globally, the Snort user community continues advancing its capabilities through ongoing contribution.
Advantages vs Commercial Competitors
While alternatives like Sourcefire’s FirePOWER and Cisco’s ThreatGRID provide capable detection, choosing Snort offers several compelling differentiators:
• Open Source Freedom – Snort is entirely free to access, deploy, and modify under the GPL license
• Supreme Customizability – User-defined rules and configurations enable unmatched tuning for specific use cases
• Constant Innovation – An active open community accelerates feature expansion through ongoing contribution
Snort Architecture Overview
Examining under the hood reveals a sensor architecture optimized for scalable packet inspection and analysis:
Packets pass through Snort‘s core subsystems:
- Decoder – Translates packets to a format for processing.
- Preprocessors – Perform detections unrelated to content inspection like protocol anomalies and denial of service patterns.
- Detection Engine – Matches traffic against signatures and built-in rules defined by Snort administrators.
- Logging & Alerting – Generates logs, issues alerts, and triggers responses for events warrantingadministrative notification.
Snort processes traffic across multiple threads for improved performance scaling.
Getting Up and Running with Snort
Snort setup consists primarily of OS-level installation steps along with definition and configuration file modifications.
Packages through standard Linux repositories simplify deployment:
$ sudo apt install snort
Registration at snort.org grants access to newer paid rulesets using a personal Oinkcode:
With installation complete, properly configuring the /etc/snort/snort.conf file ensures everything functions as intended.
Understanding Snort Rules and Writing Custom Signatures
Snort relies heavily on rules that analyze traffic patterns and make comparisons against known malicious activity. Rules contain several standardized sections:
alert tcp $EXTERNAL_NET any -> $HOME_NET 25 (msg:"Potential SMTP Brute Force"; \
flow:to_server,established; content:"auth login"; nocase; classtype:attempted-recon; sid:10000123; rev:1;)This breaks down into functions including:
- Rule Action – Action when triggered such as sending an alert or dropping traffic.
- Protocol & Addressing – Defines TCP along with source/destination details.
- Rule Options – Direction, port numbers, or payload contents comprising the match criteria.
- Event Information – Unique ID, revision and descriptive message.
Well-crafted rules target specific combinations of IP addresses, ports, protocols, payloads, and thresholds. Examples include:
# Detect Local File Inclusion Attempts alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"Local File Inclusion Attempt"; flow:to_server,established; uricontent:"/etc/"; nocase; reference:url,cwe.mitre.org/data/definitions/98.html; classtype:web-application-attack; sid:10000125; rev:2;)alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 1433 (msg:"SQL Injection Attempt"; flow:to_server,established; content:"‘|28 29 20 4F 52 20 53 45 4C 45 43 54 20"; pcre:"/[s|S][q|Q][l|L]\s+[i|I][n|N]/i"; threshold:type limit, track by_src, count 1, seconds 60; reference:url,cwe.mitre.org/data/definitions/89.html; classtype:attempted-user; sid:10000127; rev:1;)
Meticulously constructed rules like these catch attackers early while avoiding false positives through precise criteria matching production traffic.
Staying Up-To-Date on Emerging Threats
The threat landscape evolves rapidly as attackers constantly change tools and adoption spreads for new malware variants and vulnerabilities. Keeping detection capabilities current requires ongoing updates. Strategies include:
- Regularly reviewing rule posts from the Snort Subscriber Rule Set and bleeding-edge Community Rule Set.
- Subscribing to emerging threat intelligence services that assess malware trends and high-impact vulnerabilities.
- Checking IDS alert reports published weekly by US-CERT on recent widespread attacks and exploitation trends.
By integrating new community signatures ahead of vulnerability disclosures and retooling homegrown custom rules, organizations can maximize their detection efficacy against emerging threats.
Snort in Action: Logs and Alerts
Whether performed manually or scheduled as a batch process, running Snort in packet capture mode generates intrusion detection system logs containing events of interest for further review:
$ sudo snort -A fast -c /etc/snort/snort.conf
Snort rules match traffic against over 86 categories of intrusion attempts, malware propagation, policy violations, denial of service patterns, and reconnaissance activity. Inspecting output alert files like snort.alert.fast provides visibility when noteworthy events occur:
Flagging severities range from high priority to informational, allowing tuning to reduce noise. Integrating detection logs with firewall data, endpoint reporting, and centralized SIEM platforms provides further analytics.
Tuning Snort for Optimal Detection Performance
Carefully tailoring configuration settings and filters ensures monitoring efficacy without overwhelming analysts. Techniques include:
- Rule Thresholds – Require multiple rule matches within a time window prior to alerting.
- IP & Port Suppression – White list legitimate scanners, user subnets, and commonly accessed services.
- Event Filtering – Specify classes of checks to enable selectively.
This drastically cuts false positives and manageable event volumes.
Administrators further optimize Snort sensor placement for visibility into different network segments, leveraging taps and switches‘ monitoring ports. Load balancing across multiple IDS instances also improves performance for large environments.
The Verdict? Snort Changes the Game for IDS
Snort’s open source platform offers game-changing community-driven innovation in network monitoring and intrusion detection. Capable functionality at no cost disrupts competitors while inviting customization and extensibility.
With over 86,000 community registered users as of 2021 and hundreds of thousands of downloads, Snort leads the category by a wide margin.
For organizations seeking heightened network visibility and early attack identification, Snort delivers superior price-performance scalable to networks of any size. Its unconditional freedom makes it the first choice for intrusion detection across the industry.
