Snort

Snort is a free and open source network intrusion prevention system (NIPS) and network intrusion detection system (NIDS) created by Martin Roesch in 1998. Snort is now developed by Sourcefire, of which Roesch is the founder and CTO.

Snort's open source network-based intrusion detection system (NIDS) has the ability to perform real-time traffic analysis and packet logging on Internet Protocol (IP) networks. Snort performs protocol analysis, content searching, and content matching. The program can also be used to detect probes or attacks, including, but not limited to, operating system fingerprinting attempts, common gateway interface, buffer overflows, server message block probes, and stealth port scans.

Snort can be configured in three main modes: sniffer, packet logger, and network intrusion detection.In sniffer mode, the program will read network packets and display them on the console. In packet logger mode, the program will log packets to the disk. In intrusion detection mode, the program will monitor network traffic and analyze it against a rule set defined by the user. The program will then perform a specific action based on what has been identified

1. Download and Extract Snort

Download the latest snort free version from snort website. Extract the snort source code to the /usr/src directory as shown below.

# cd /usr/src

# wget -O snort-2.8.6.1.tar.gz https://www.snort.org/downloads/116

# tar xvzf snort-2.8.6.1.tar.gz

Note: We also discussed earlier about Tripwire (Linux host based intrusion detection system) and Fail2ban (Intrusion prevention framework)

2. Install Snort

Before installing snort, make sure you have dev packages of libpcap and libpcre.

# apt-cache policy libpcap0.8-dev
libpcap0.8-dev:
  Installed: 1.0.0-2ubuntu1
  Candidate: 1.0.0-2ubuntu1

# apt-cache policy libpcre3-dev
libpcre3-dev:
  Installed: 7.8-3
  Candidate: 7.8-3

Follow the steps below to install snort.

# cd snort-2.8.6.1

# ./configure

# make

# make install

3. Verify the Snort Installation

Verify the installation as shown below.

# snort --version

   ,,_     -*> Snort! <*-
  o"  )~   Version 2.8.6.1 (Build 39)
   ''''    By Martin Roesch & The Snort Team: https://www.snort.org/snort/snort-team
           Copyright (C) 1998-2010 Sourcefire, Inc., et al.
           Using PCRE version: 7.8 2008-09-05

4. Create the required files and directory

You have to create the configuration file, rule file and the log directory.

Create the following directories:

# mkdir /etc/snort

# mkdir /etc/snort/rules

# mkdir /var/log/snort

Create the following snort.conf and icmp.rules files:

# cat /etc/snort/snort.conf
include /etc/snort/rules/icmp.rules

# cat /etc/snort/rules/icmp.rules
alert icmp any any -> any any (msg:"ICMP Packet"; sid:477; rev:3;)

The above basic rule does alerting when there is an ICMP packet (ping).

Following is the structure of the alert:

       (rule options)

5. Execute snort

Execute snort from command line, as mentioned below.

# snort -c /etc/snort/snort.conf -l /var/log/snort/

Try pinging some IP from your machine, to check our ping rule. Following is the example of a snort alert for this ICMP rule.

# head /var/log/snort/alert
[**] [1:477:3] ICMP Packet [**]
[Priority: 0]
07/27-20:41:57.230345 > l/l len: 0 l/l type: 0x200 0:0:0:0:0:0
pkt type:0x4 proto: 0x800 len:0x64
209.85.231.102 -> 209.85.231.104 ICMP TTL:64 TOS:0x0 ID:0 IpLen:20 DgmLen:84 DF
Type:8  Code:0  ID:24905   Seq:1  ECHO

Alert Explanation
A couple of lines are added for each alert, which includes the following:

• Message is printed in the first line.
• Source IP
• Destination IP
• Type of packet, and header information.

If you have a different interface for the network connection, then use -dev -i option. In this example my network interface is ppp0.

# snort -dev -i ppp0 -c /etc/snort/snort.conf -l /var/log/snort/

Execute snort as Daemon

Add -D option to run snort as a daemon.

# snort -D -c /etc/snort/snort.conf -l /var/log/snort/

Nessus

Nessus is a proprietary vulnerability scanner available free of charge for personal use. There are over 40,000 plugins covering a large range of both local and remote flaws.

Installation

Download and extract the nessus tarball available in the AUR.

Go to https://tenable.com/products/nessus/nessus-download-agreement, agree to the license, and download the package:

• 32-bit: Nessus-5.0.2-fc16.i386.rpm
• 64-bit: Nessus-5.0.2-fc16.x86_64.rpm

Move the RPM file into the nessus directory (i.e. the directory you extracted the tarball's contents to).

Then, build and install the package and any needed dependencies:

$ makepkg -csi

Post-installation setup

Create an SSL certificate for the Nessus web interface:

# /opt/nessus/sbin/nessus-mkcert

Register your email at https://www.tenable.com/products/nessus/nessus-plugins/obtain-an-activation-code and wait for your key to be emailed to you. Then, download all the plugins from the feed with:

# /opt/nessus/bin/nessus-fetch --register 

Create a Nessus admin user (unrelated to Unix-style users):

# /opt/nessus/sbin/nessus-adduser

Usage

The nessus package provides a nessusd.service unit file, see systemd for details.

Access the web interface at https://localhost:8834 and/or use the commandline interface (/opt/nessus/bin/nessuscmd). In most browsers, you will need to manually accept the SSL certificate you created for the server.

Wireshark
 

Wireshark is a free and open-source packet analyzer. It is used for network troubleshooting, analysis, software and communications protocol development, and education. Originally named Ethereal, in May 2006 the project was renamed Wireshark due to trademark issues.

Wireshark is cross-platform, using the GTK+ widget toolkit to implement its user interface, and using pcap to capture packets; it runs on various Unix-like operating systems including Linux, Mac OS X, BSD, and Solaris, and on Microsoft Windows. There is also a terminal-based (non-GUI) version called TShark.


Wireshark is very similar to tcpdump, but has a graphical front-end, plus some integrated sorting and filtering options.

Wireshark allows the user to put network interface controllers that support promiscuous mode into that mode, in order to see all traffic visible on that interface, not just traffic addressed to one of the interface's configured addresses and broadcast/multicast traffic. However, when capturing with a packet analyzer in promiscuous mode on a port on a network switch, not all of the traffic traveling through the switch will necessarily be sent to the port on which the capture is being done, so capturing in promiscuous mode will not necessarily be sufficient to see all traffic on the network. Port mirroring or various network taps extend capture to any point on net; simple passive taps are extremely resistant to malware tampering.

On Linux, BSD, and Mac OS X, with libpcap 1.0.0 or later, Wireshark 1.4 and later can also put wireless network interface controllers into monitor mode.
 

Features

Wireshark is software that "understands" the structure of different networking protocols. Thus, it is able to display the encapsulation and the fields along with their meanings of different packets specified by different networking protocols. Wireshark uses pcap to capture packets, so it can only capture the packets on the types of networks that pcap supports.

• Data can be captured "from the wire" from a live network connection or read from a file that recorded already-captured packets.
• Live data can be read from a number of types of network, including Ethernet, IEEE 802.11, PPP, and loopback.
• Captured network data can be browsed via a GUI, or via the terminal (command line) version of the utility, TShark.
• Captured files can be programmatically edited or converted via command-line switches to the "editcap" program.
• Data display can be refined using a display filter.
• Plug-ins can be created for dissecting new protocols.
• VoIP calls in the captured traffic can be detected. If encoded in a compatible encoding, the media flow can even be played.
• Raw USB traffic can be captured.

Wireshark's native network trace file format is the libpcap format supported by libpcap and WinPcap, so it can exchange files of captured network traces with other applications using the same format, including tcpdump and CA NetMaster. It can also read captures from other network analyzers, such as snoop, Network General's Sniffer, and Microsoft Network Monitor.

Security

Capturing raw network traffic from an interface requires elevated privileges on some platforms. For this reason, older versions of Ethereal/Wireshark and tethereal/TShark often ran with superuser privileges. Taking into account the huge number of protocol dissectors that are called when traffic is captured, this can pose a serious security risk given the possibility of a bug in a dissector. Due to the rather large number of vulnerabilities in the past (of which many have allowed remote code execution) and developers' doubts for better future development, OpenBSD removed Ethereal from its ports tree prior to OpenBSD 3.6.

Elevated privileges are not needed for all of the operations. For example, an alternative is to run tcpdump, or the dumpcap utility that comes with Wireshark, with superuser privileges to capture packets into a file, and later analyze the packets by running Wireshark with restricted privileges. To make near real time analysis, each captured file may be merged by mergecap into growing file processed by Wireshark. On wireless networks, it is possible to use the Aircrack wireless security tools to capture IEEE 802.11 frames and read the resulting dump files with Wireshark.

As of Wireshark 0.99.7, Wireshark and TShark run dumpcap to do traffic capture. On platforms where special privileges are needed to capture traffic, only dumpcap needs to be set up to run with those special privileges: neither Wireshark nor TShark need to run with special privileges, and neither of them should be run with special privileges.

PACKAGE INSTALL:

It is good to stress that there is no Wireshark package for the Ubuntu releases before edgy (6.10) and no Wireshark stable package for Debian too.
In these cases you need to download an Ethereal package or to compile Wireshark from source.
Ubuntu

Ubuntu releases before Edgy (6.10):

Ubuntu releases starting from Edgy (6.10):

As of March 2007, there is no stable Debian version for Wireshark, so you can download either Ethereal

or an unstable version of wireshark under the debian package website.

To launch Wireshark or Ethereal under Debian or Ubuntu:

MANUAL INSTALL:

Install the compilation tools:

To compile Wireshark successfully, you need to install the development files for the GTK+ and GLib libraries.

Install Checkinstall to easier manage your softwares installed from their source code.

Download and uncompress the Wireshark source code:

Check the Wireshark dependencies:

If you see this error message, you need to install the GTK+ and GLib libraries as indicated above:

checking for GTK+ - version >= 2.0.0... no
*** Could not run GTK+ test program, checking why...
*** The test program failed to compile or link. See the file config.log for the
*** exact error that occured. This usually means GTK+ is incorrectly installed.
checking for pkg-config... (cached) /usr/bin/pkg-config
checking for GLIB - version >= 2.0.0... no
*** Could not run GLIB test program, checking why...
*** The test program failed to compile or link. See the file config.log for the
*** exact error that occured. This usually means GLIB is incorrectly installed.
configure: error: GLib2 distribution not found.

Compile and install the tool:

To launch Wireshark:

TSHARK INSTALL:

Tshark in the CLI version of Wireshark and can be easily installed as follows:

Launch Wireshark or Ethereal: (What is the difference between Ethereal and Wireshark?)
#wireshark
#ethereal
Wireshark Ethereal

Select a capture interface.

Capture -> Options
Select a network interface and click on Start.

Wireshark Ethereal Capture options


Result after Wireshark launch.

Wireshark Ethereal Capture options


To use Wireshark at its best, it is important to understand the platform and know how to manipulate the filters to find the information you are looking for.

After having launched Wireshark with success, we are ready to examine the Wireshark platform in order to use this fantastic tool.

wireshark frontend has
1. MENUS
The eight menus at the top of the platform are used to configure Wireshark:

- "File"
- "Edit"
- "View"
- "Go"
- "Capture"
- "Analyze"
- "Statistics"
- "Help"     Opens or save a capture.
Finds or mark packets. Configures the global preferences.
Configures the Wireshark platform view.
Reach data inside the capture.
Sets capture filters options and starts the capture.
Sets Analyze options.
Views Wireshark statistics.
Finds local or online support.



2. SHORTCUTS
Useful shortcuts are available just below the menus.
Information can be obtained when you move the mouse pointer over the icons.

3. DISPLAY FILTER
The display filter is used to search inside the captured logs.
Do not confound the capture and display filters. For full details, check the Wireshark filters tutorial.


4. PACKET LIST PANE
The packet list pane displays all the captured packets. You can get information such as the source or destination MAC/IP addresses, the TCP/UDP ports number, the protocol or the packet content.

If an OSI layer 2 packet is captured you will see MAC addresses in the source and destination columns and, of course, nothing in the port column.
If an OSI layer 3 or upper packet is captured you will see IP addresses in the source and destination columns. The port column is populated only if the packet is at the layer 4 or upper.

You can add/remove columns or change some colors in the pane as follows:
Edit menu -> Preferences

5. PACKET DETAILS PANE
The packet details pane gives in depth information about a packet selected in the packet list pane.
The information is displayed per OSI layer and can be expanded and collapsed. On the screenshot below, the HTTP information is expended.

6. DISSECTOR PANE
The dissector panel also called "packet bytes pane" by Wireshark, displays the same information as those provided on the packet details pane but in the hexadecimal style.
In the example above, we selected the TCP port number (80) in the packet details pane and its hexadecimal equivalent is automatically displayed in the dissector pane (0050).

7. MISCELLANOUS
At the bottom of the platform, you can find the following information:

- The network card used for the capture.
- If the capture is running or stopped.
- Where the capture is stored on the hard drive.
- the capture size.
- the number of captured packets. (P)
- the number of displayed packets. (D) (Packets matching the display filter)
- the number of marked packets. (M)