1. Snort Intrusion detection system Charles Beckmann Anthony Magee Vijay Iyer

2. 2 Topics  Software  Setup  Motivations  Rules  Performance  Collected Data  References

3. 3 Software  Debian 5.0 - Robust and stable platform with large community support  IPtables - Popular and preferred on Debian  Snort - Open source, mature, rule driven IDS  Guardian Active Response - Active firewall modification scripts for several firewall programs (not to be confused with DansGuardian)

4. Snort  Network intrusion detection and prevention system (IDS)  Analyzes incoming traffic for signs of attack  Protocol analysis  Heuristic content matching  Rule based  Report generation

5. 5 Guardian Active Response  Designed for Snort  Whitelist for preventing unwanted blocking  Written is Perl  Supports watching multiple IPs

6. 6 IPtables  Default firewall controller for Debian  Simple to use  Provides fine grained control when needed  Example rule to drop all MySQL traffic to a specific machine  iptables -A FORWARD -p tcp -m tcp -s 0.0.0.0/0 -d --dport 3306 -m state --state NEW -j DROP

7. Motivations: Why do we need Snort?  Many forms of attack can go completely undetected by casual observation  Many modern attacks, such as DDOS, are impossible to prevent or contain using static firewall rules  We need a cheap and automated solution

8. Motivations: Why use Guardian?  Uses snort logs to dynamically block threats

9. SNORT Network Configuration

10. Setup & Integration  Installed on a dedicated machine: The Acronym Friendly Vast Lab Intrusion Detection and Prevention System (AFVLIDPS)  Passive connection to hub sniffs incoming traffic without incurring additional delay  There is a delay, however, between the start of the attack and the Guardian response

11. 11 Rules  Avoid service interruptions due to false positives  Creating rules requires nontrivial amounts of data and analysis  Quality of Service  Restrict to times of day  Restrict based on attack frequency  Staged restrictions

12. Performance  Guardian can read the logs quickly  MySQL logs are used to view reports and do not affect speed of system  QoS - Quality of Service  Block all potentially harmful traffic?  Limit harmful traffic?  Leak a little traffic from harmful sources?

13. Data / Results

14. References  “Design Of an Autonomous Anti DDos network” by Angel Cearns “Design Of an Autonomous Anti DDos network” by Angel Cearns  http://www.snort.org http://www.snort.org  http://www.iptables.org http://www.iptables.org  http://www.chaotic.org/guardian/ http://www.chaotic.org/guardian/ 14

15. This is the last slide  There are no further slides after this slide.  No, Really.  You may now ask questions  They will be answered with questionable sincerity