INSTALLING AND USING SNORT

Alejandro Alcantar

• Snort is an Intrusion Detection System (IDS) and Intrusion Prevention System (IPS)

• Snort can be used to block malware, and other intrusions on your computer.

• Snort, although initially programmed for Linux and other Command Line Interface (CLI) systems, can be configured to run on Windows.

• Before configuring Snort to run on Windows, your system is required to have WinPCap and Barnyard installed.

What Is Snort?

Installing WinPCap• Before you can install Snort, your

system is require to have WinPCap 4.1.1 or newer.

• Open up a your web browser and go to your preferred search engine.

• Once there search for WinPCap and download the latest version.

• In this case the latest version is 4.1.3.

• After the download run the installer and go through the program setup like you would normally.

Installing Barnyard• Other than WinPCap the only other system

requirement for installing Snort is Barnyard.• So, again, open up your browser and go to

your search preferred search engine.• Once there search for a Barnyard download

for Windows, this may be a little difficult to find so make sure your include which OS you are using in the search.

• Once you find it, download it and run the installer.

• Once the installer is running, go through the program setup like you normally would.

Find Snort

• First we need to find the program that we need to install.• So we open our web browser and go to any search engine.• Search for Snort and open the result link to the program website.• Once on the site go to the download section of the site.

Downloading and Installing

• There are multiple sections with download links.

• The one we are going to download from is the Binaries section.

• Under the Binaries list there are multiple download links.

• We are looking for the Installer with the right file type to run on our OS.

• We are using Windows, so we are going to use the executable (.exe) file.

• Download the file and run through the set up process.

• If you are using Internet Explorer, you may have to save the file and rename it as an .exe file.

Downloading Snort Rules

• Now to download the your Snort rules, and get the program configuration started.• On the Snort site, click the get rules button and it will take you to the rules download page.• Here you are going to download the rules file that either matches or is closest to the version

of Snort that you have downloaded.• Once downloaded extract the files to your Snort folder.

Snort Documentation

• Now we need to consult the documentation to configure Snort, which you can find on the Snort site, or if you prefer on just about any search engine.

• Once you open your Snort documentation, read through and follow the instruction in order to configure your Snort program.

• The documentation is telling you to open the .conf file and edit certain lines in it.

• To do this find the file in your etc folder in your Snort folder.

• Right-click the program and open it with WordPad.

• In the .conf file you are going to search for the lines that you are instructed to change .

• Once you find them, make the necessary changes.

• Be sure to double check your changes before you save and close the file.

• In Fig. 1 you are being asked to run commands in your Command Prompt, so open up your Command Prompt by opening your Start menu and searching “cmd”.

• Run the first command that is asks you to, and your screen should look like figure 2, and from this you are going to find your interface number.

• Fig. 1 then asks you to run a second command in which “X” is to be replaced with your interface number, so if done correctly, you should get a long stream of data like in Fig. 3.

Fig. 1

Fig. 2

Fig. 3

• You are now asked to open a new Command Prompt window and run the command “ping google.com”.

• If it is done correctly you should end up with two Command Prompt windows that look like the two above.

• The documentation now instructs you to close the previous two Command Prompt windows and open a new one.

• Run the new command in your new Command Prompt window, and if no errors occur you window should look like the second figure.

• If an error does occur, you will then need to open your .conf file in WordPad again, and make correction to the appropriate lines, until running the command gives you a screen similar to the one displayed in the second figure.

• You can identify the necessary line by looking for the number within the <> in the error message.