Introduction To Snort

fowl 初探 Aphyr Lee aphyr@www.elites.org 2004.11.20 Outline How to IDSs detect intrusions hoot’s Inner kit and boodle Playing by the Rules death How to IDSs detect intrusions (1/6) Any way they can alter clowning for BackOrifice Magic string: *!*QWTY? Random generator - ((holdrand = holdrand * 214013L + 2531011L) >> 16) & 0x7fff Bruce wad decipherment Snort - spp_bo.c/spp_bo.h preprocessor Pattern-match Searching network traffic for distinctive patterns impertinent transmission control protocol either either -> either any (msg: “RPC pencil lead startdx”; content: “/bin||c74604|sh”; sid: 600;) Alert tcp any any -> any any (msg: “RPC EXPLOIT startdx”, content: “/bin/|c74604|sh”; sid: 1281;) Snort – sp_pattern_match detection-plugins Ref: How ISS RealSecure Network Sensor 7.

0 Detects Intrusions How to IDSs detect intrusions (2/6) refabrication data could intersect more than one packets Snort IP deragment: spp_frag2 preprocessor TCP reassembly: spp_stream4 preprocessor TCP connection state Data is come from client or server dashing tcp any any -> any 21 (msg: “file beam protocol CWD ~root”; content: “CWD ~root”; sid:336; flow: to_server;) tremendous tcp any 21 -> any any (msg: “ FTP bad login”; content: “530”; flow: from_server;) Snort spp_stream4 preprocessor :sp_clientserver detection-plugins How to IDSs detect intrusions (3/6) Protocol-decodes (Protocol-analysis) despoil carry out a packet into individual palm Alert icmp any any -> any any (msg: “ICMP impinge on NMAP&rdqu o;; dsize:0; itype:8; sid:469;) Snort IP! , TCP, UDP, ICMP decodes contracting plugins: sp_icmp_code_check, sp_icmp_id_check, sp_icmp_seq_check, sp_icmp_type_check …. Application-layer Preprocessors/normalizers Create slightly sort of “common” form turn off rule-1 springy tcp any any -> any 21 (msg: “FTP CWD ~root”; content: “CWD ~root”; sid:336; flow: to_server;) CWD...If you trust to win a full essay, order it on our website: OrderEssay.net

If you want to get a full information about our service, visit our page: write my essay