SWEETSTUDY.COM YOUR HOMEWORK ANSWERS
chat0
Home.Literature.
Help.
Log in / Sign up
Snort Lab #2
profile
StanTheMan
Lab2_DaaS_full_instructions_with_commands_screenshots_July_9_20174.docx
Home>Information Systems homework help>Snort Lab #2
INFA630 Lab #2 Step-by-Step Instructions with Screen Shots
Open up a terminal.
Execute the following:
cd /etc/snort/rules/rules
Execute the following to use the nano editor:
sudo nano local.rules
Enter the StudentFirst credential (username: StudentFirst, password: Cyb3rl@b)
You will see the following screen.
Scroll down by using down arrow key in your keyboard. Then you will see the following:
The last 3 rules were created for testing purposes. Comment them out by placing # character in the front of each line as follows:
Now, you may enter your own rule to detect the traffic to/from invalid web site you chose.
I simply created a rule for detecting any traffic whose destination port is equal to 443 (SSL/TLS). This port is used for most of the SSL/TLS enabled web servers. Many web servers are automatically redirect/utilize 443 port for secure connection, even though you specify http://… in your web browser.
For example, www.mdlottery.com seems to be utilizing this mechanism.
Depending upon the actual pattern matching features you want to use in your rule, this port number information may be used or may not be used e.g., if you are trying to detect the occurrence of mdlottery.com in packet payloads.
So, please replace this last rule with yours.
Press ^O (Ctrl-O) to write back to the file local.rules
Press Enter.
Press ^X (Ctrl-X in your keyboard) to exit from nano.
Now, you are ready to run Snort.
Execute the following to go to the home directory:
cd ~
Execute:
sudo snort c /etc/snort/snort.conf A console > alert.txt
Enter the StudentfFirst credential and wait until you will see the following (it may take a while):
Now open up a web browser while snort is running. I chose to open Firefox.
Then, type in your chosen URL. I chose www.mdlottery.com
It may take a really long time (several minutes) until you see the page loaded. You dont really need to wait until the page is loaded. Snort will capture the upstream traffic (e.g., HTTP request messages) and generate alerts.
You may wait about 20 or 30 seconds, and place the cursor on top of the terminal (on which the snort is runnig) and click it to make it appear in the foreground as follows.
As is shown, snort is still running. Press ^C (Ctrl-C in your keyboard together) to terminate the running snort. Then snort execution will be terminated.
You may check the contents of alert.txt by executing:
sudo nano alert.txt
Enter the StudentFirst credential again.
You may search for your own sid (e.g., 1000004) by typing in ^W (Ctrl-W together on your keyboard) and entering the sid number as follows:
The following shows that there were alerts generated with sid=1000004.
You may submit this type of screen shot to the Assignment folder in LEO.
Now you are done!
Applied Sciences
Architecture and Design
Biology
Business & Finance
Chemistry
Computer Science
Geography
Geology
Education
Engineering
English
Environmental science
Spanish
Government
History
Human Resource Management
Information Systems
Law
Literature
Mathematics
Nursing
Physics
Political Science
Psychology
Reading
Science
Social Science
Home
Homework Answers
Blog
Archive
Tags
Reviews
Contact
twitterfacebook
Copyright © 2022 SweetStudy.com
