Introduction To Snort

fowl 初探 Aphyr Lee aphyr@www.elites.org 2004.11.20 Outline How to IDSs detect intrusions fizzle’s Inner kit and boodle Playing by the Rules destination How to IDSs detect intrusions (1/6) Any way they can alter discombobulate for BackOrifice Magic string: *!*QWTY? Random generator - ((holdrand = holdrand * 214013L + 2531011L) >> 16) & 0x7fff Bruce wad decipherment Snort - spp_bo.c/spp_bo.h preprocessor Pattern-match Searching network traffic for distinctive patterns impudent transmission control protocol either either -> each any (msg: “RPC catch on startdx”; content: “/bin||c74604|sh”; sid: 600;) Alert tcp any any -> any any (msg: “RPC EXPLOIT startdx”, content: “/bin/|c74604|sh”; sid: 1281;) Snort – sp_pattern_match detection-plugins Ref: How ISS RealSecure Network Sensor 7.

0 Detects Intrusions How to IDSs detect intrusions (2/6) refabrication entropy could intersect more than one packets Snort IP deragment: spp_frag2 preprocessor TCP reassembly: spp_stream4 preprocessor TCP connection state Data is come from client or server dashing tcp any any -> any 21 (msg: “file ravish protocol CWD ~root”; content: “CWD ~root”; sid:336; flow: to_server;) springy tcp any 21 -> any any (msg: “file transfer protocol bad login”; content: “530”; flow: from_server;) Snort spp_stream4 preprocessor :sp_clientserver detection-plugins How to IDSs detect intrusions (3/6) Protocol-decodes (Protocol-analysis) violate carry out a packet into individual field Alert icmp any any -> any any (msg: “I CMP criticise NMAP”; dsize:0; itype:8! ; sid:469;) Snort IP, TCP, UDP, ICMP decodes contracting plugins: sp_icmp_code_check, sp_icmp_id_check, sp_icmp_seq_check, sp_icmp_type_check …. Application-layer Preprocessors/normalizers Create close to sort of “common” form turn off rule-1 officious tcp any any -> any 21 (msg: “file transfer protocol CWD ~root”; content: “CWD ~root”; sid:336; flow: to_server;) CWD...If you trust to becharm a full essay, order it on our website: OrderEssay.net

If you want to get a full information about our service, visit our page: write my essay