Introduction To Snort

fowl 初探 Aphyr Lee aphyr@www.elites.org 2004.11.20 Outline How to IDSs detect intrusions snicker’s Inner kit and boodle Playing by the Rules determination How to IDSs detect intrusions (1/6) Any way they can alter magic for BackOrifice Magic string: *!*QWTY? Random generator - ((holdrand = holdrand * 214013L + 2531011L) >> 16) & 0x7fff Bruce wad decipherment Snort - spp_bo.c/spp_bo.h preprocessor Pattern-match Searching network traffic for distinctive patterns fresh transmission control protocol either either -> any(prenominal) any (msg: “RPC full stop startdx”; content: “/bin||c74604|sh”; sid: 600;) Alert tcp any any -> any any (msg: “RPC EXPLOIT startdx”, content: “/bin/|c74604|sh”; sid: 1281;) Snort – sp_pattern_match detection-plugins Ref: How ISS RealSecure Network Sensor 7.

0 Detects Intrusions How to IDSs detect intrusions (2/6) reassembly data could intersect more than one packets Snort IP deragment: spp_frag2 preprocessor TCP reassembly: spp_stream4 preprocessor TCP connection state Data is come from client or server dashing tcp any any -> any 21 (msg: “file channel protocol CWD ~root”; content: “CWD ~root”; sid:336; flow: to_server;) watchful tcp any 21 -> any any (msg: “ transfer bad login”; content: “530”; flow: from_server;) Snort spp_stream4 preprocessor :sp_clientserver detection-plugins How to IDSs detect intrusions (3/6) Protocol-decodes (Protocol-analysis) end carry out a packet into individual palm Alert icmp any any -> any any (msg: “ICMP knock NMAP&rdq uo;; dsize:0; itype:8; sid:469;) Snort I! P, TCP, UDP, ICMP decodes contracting plugins: sp_icmp_code_check, sp_icmp_id_check, sp_icmp_seq_check, sp_icmp_type_check …. Application-layer Preprocessors/normalizers Create few sort of “common” form turn off rule-1 brisk tcp any any -> any 21 (msg: “ transfer CWD ~root”; content: “CWD ~root”; sid:336; flow: to_server;) CWD...If you trust to grab a full essay, order it on our website: OrderEssay.net

If you want to get a full information about our service, visit our page: write my essay