Snort IDS System for Linux.

Snort is the foremost Open Source Intrusion Prevention System (IPS) in the world. Snort IPS uses a series of rules that help define malicious network activity and uses those rules to find packets that match against them and generates alerts for users.

Snort is a libpcap-based packet sniffer/logger which is used as a lightweight network intrusion detection system. It features rules-based logging and can perform content searching/matching in addition to detecting a variety of other attacks and probes, such as buffer overflows, stealth port scans, CGI attacks, SMB probes and much more. Snort has a real-time alerting capability, with alerts being sent to syslog, a separate "alert" file, or even to a Windows computer via Samba.

Snort is a free open source network intrusion detection system (IDS) and intrusion prevention system (IPS), that was created in 1998 by Martin Roesch, founder and former CTO of Sourcefire. Snort is now owned and developed by Cisco, who purchased Sourcefire in 2013.

Latest version: 2.9.20-0+deb11u1 Update:2MB

This update affects the following installed packages:

• snort
• snort-common
• snort-common-libraries
• snort-rules-default

Total size: 2 MB

Available in Update Manager !

Previous version: 2.9.15.1-5

Even if you are just running a desktop version, I recommend you install Snort !

Snort analyzes network traffic in real-time and flags up any suspicious activity. In particular, it looks for anything that might indicate unauthorized access attempts and other attacks on your network.

This package and others are available in LMDE5 repository:

• snort - V2.915-1.15 Size: 11MB
• oinkmaster - Snort Rules Manager
• FWsnort - Snort to IP-tables rule translator - Only one not installed by default.
• snort-common-libraries
• snort-rules-default

There are three things you should know about:

• Community Rules: These are freely available rule sets, created by the Snort user community.
   
• Registered Rules: These rule sets are provided by Talos. They are freely available also, but you must register to obtain them. Registration is free and only takes a moment. You’ll receive a personal oinkcode that you need to include in the download request.
   
• Subscription Rules: These are the same rules as the registered rules. However, subscribers receive the rules about a month before they’re released as free rule sets for registered users. At the time of writing, 12-month subscriptions start at USD $29 for personal use and USD $399 for business use.

Nothing is really free...

Configuring SNORT using nano or gedit editor:

sudo nano /etc/snort/snort.conf

Press Enter.

Find the line:

"ipvar HOME_NET any”

Then replace the “any” with the CIDR notation address range of your network.

Save and exit.

Network interface card mode:

Network interface cards normally ignore traffic that isn’t destined for their IP address, but you will want Snort to detect suspicious network traffic addressed to any device on your network, not just network traffic that happens to be sent to the computer on which Snort is installed.

To make the Snort computer’s network interface listen to all network traffic, you will need to set it to promiscuous mode.

First run:

ip addr

Press Enter, then copy and paste your NIC like this:

sudo ip link set enp2s0f0 promisc on

Press Enter.

Command-line options are:

• -d: Filters out the application layer packets.
•  -l /var/log/snort/: Sets the logging directory.
• -h 192.168.1.1/24: This doesn’t set the home network, that was set in the “snort.conf” file.
  With this value set to the same value as the home network, the logs are structured so that content from suspicious remote computers is logged into directories named after each remote computer.
• -A console: Sends alerts to the console window.
• -c /etc/snort/snort.conf: Indicates which Snort configuration file to use.

How to run Snort via a terminal window:

sudo snort -d -l /var/log/snort/ -h 192.168.1.1/24 -A console -c /etc/snort/snort.conf

Press Enter.

Snort doesn’t have graphical user interface.

This means commandline ( CLI ) in most cases, however there are some third party GUI's.

You might want to check out:

• PulledPork "Which is not recently updated" - A joke if you aren't comfortable with commandline...

Besides having a paid Antivirus solution installed, you will want this as well !

►Developers website