This document was written when I created an IDS sensor with Snort and
using some statistic tools in order to help others implementing it. If at
least one out there can be helped it has been worth the work.
Snort is an excellent Network Intrusion Detection System (NIDS) for various
unices. The Snort homepage can be found at http://www.snort.org/. The version
described here is 1.8.3 which was the actual version at the time of writing.
The statistic tools I will describe here are ACID, a database analysis tool
for Snort which can be found at http://www.cert.org/kb/acid/ and
SnortSnarf, a statistic tool for Snort logs downloadable from
http://www.silicondefense.com/software/snortsnarf/index.htm.
Additional support packages are needed for ACID. These are a PHP4 capable
webserver like apache (http://www.apache.org/), PHPlot used for
creating graphs in PHP (http://www.phplot.com/) and ADODB used
for connecting to databases with PHP (http://php.weblogs.com/ADODB/).
The description also includes which additional software is needed for ACID
and how to configure along with some scripts I use including a changed
version of the snortd initscript and a short chapter about swatch (http://www.stanford.edu/~atkins/swatch) a log file watcher script written
in perl. I created a swatch RPM which can be found at http://www.lug-burghausen.org/projects/Snort-Statistics/swatch-3.0.2-1.noarch.rpm.
One hint for those interested in maintaining more than one snort sensor: You
might take a look at IDSPM (IDS Policy Manager) at http://www.activeworx.com/ which is
an application to maintain various sensors with different policies along with
merging capabilities for new rules and a lot more. The only "nasty" thing is
that it runs on W2K/XP and is not (yet?) Open Source.
This document is copyrighted (c) 2001, 2002 Sandro Poppi and is
distributed under the terms of the Linux Documentation Project
(LDP) license, stated below.
Unless otherwise stated, Linux HOWTO documents are
copyrighted by their respective authors. Linux HOWTO documents may
be reproduced and distributed in whole or in part, in any medium
physical or electronic, as long as this copyright notice is
retained on all copies. Commercial redistribution is allowed and
encouraged; however, the author would like to be notified of any
such distributions.
All translations, derivative works, or aggregate works
incorporating any Linux HOWTO documents must be covered under this
copyright notice. That is, you may not produce a derivative work
from a HOWTO and impose additional restrictions on its
distribution. Exceptions to these rules may be granted under
certain conditions; please contact the Linux HOWTO coordinator at
the address given below.
In short, we wish to promote dissemination of this
information through as many channels as possible. However, we do
wish to retain copyright on the HOWTO documents, and would like to
be notified of any plans to redistribute the HOWTOs.
If you have any questions, please contact
<linux-howto at metalab.unc.edu>
No liability for the contents of this documents can be accepted.
Use the concepts, examples and other content at your own risk.
As this is a new edition of this document, there may be errors
and inaccuracies, that may of course be damaging to your system.
Proceed with caution, and although this is highly unlikely,
the author(s) do not take any responsibility for that.
All copyrights are held by their respective owners, unless
specifically noted otherwise. Use of a term in this document
should not be regarded as affecting the validity of any trademark
or service mark.
Naming of particular products or brands should not be seen
as endorsements.
You are strongly recommended to take a backup of your system
before major installation and backups at regular intervals.
Credits go to a variaty of people including
If I missed someone it was not because of not honoring her or his work!
Feedback is most certainly welcome for this document. Without
your submissions and input, this document wouldn't exist. Please
send your additions, comments and criticisms to the following
email address : <spoppi at gmx.de>.
There are currently no translations available.
