Intrusion Detection System (IDS)
One of the main selling points of an intrusion detection system is that you can trace the attack to learn more about the hacker and prepare for legal repercussions. The IDS is also a good tool to find out what is going on behind the firewall. For example, are your personnel adhering to security protocol or are they also hacking your system. When looking to purchase an IDS system, look at how the managers and agents interact with each other. All transmissions should be encrypted.
E-trust and Snort are popular IDS Systems. Snort is open source freeware. To use Snort,in windows, you should first download WinPcap. WinPcap is a driver that lets you sniff packets from a network interface. To work with Snort, you need to configure the Snort.Conf file. If, for example, the ip address was 192.168.0.1, the Snort address would be 192.168.0.1/24 and the subnet would be 255.255.255.0. For multiple subnets, separate the IP with square brackets and a comma [192.168.0.1/24, 192.168.0.2/24]. You should also add rules to this same file.
After using Snort, go to the Snort directory and open the alert.ids file. This file contains the packets that Snort thinks are attacks. On the command line you will key in type alert.ids to see the packet attacks.
To use Snort to capture data at the application layer, you will need to restart with the command Snort -d -c snort.conf -l e:\snort.log. If you find ICMP unreachable destinations, it could be due to a dos attack or a URL that doesn’t exist.
Types of IDS
Host Based
The program reads the log files and issues alerts.
Network Based
A NIC is set in promiscuous mode to listen for attacks.
|
