Linux Belgium

SNORT Intrusion Detection System

Snort is great Network Intrusion Detection Software (IDS). It's completely free and has impressive capabilities. It has features unseen with any commercial IDS. As with all IDSes it has it's advantages and disadvantages. We sum them up for your convenience:

Advantages:

Runs on Linux and Windows

Free of licensing costs (you can buy a nice new server AND the installation service for the price of commercial IDSes)

Immediately available for download

Can be highly customized to your specific environment

Can work decentralised with monitoring probes on different locations of your network

Can process more than 400Mbit/s per node without dropped packets (no commercial IDS has this performance)

Can use a MySQL database as backend

Has a nice web-interface with a lot of detail and explenations

Can auto-update it's rules

Can be configured to automatically bring down certain parts of your network when an intrusion occurs

Can run on your network without being detectable (also a unique feature)

Disadvantages:

It is difficult to setup by those who have not done it before

It requires a good installed and running Apache, MySQL, PHP and some other software to do it's magic

It can only be used to do Intrusion Detection behind the firewall (connecting it to the Internet will generate too much positives).

Must be tweaked to reduce the 'false positives' specific to your environment.

The Snort website doesn't give the impression of it's advanced features and capabilities.

The monitoring sensors should be installed with unidirectional Ethernet cables to prevent any security concerns.

On Windows the installation takes longer and the performance is not so impressive. It's also discouraged because of the security reputation of Windows.

Other interesting things to look at:

ACID is the original web interface for snort

BASE can be seen as the follow-up on acid and provides a better experience

sguil is a newer standalone client, with very interesting features...

We can assist you in setting up Snort for you and automate everything:
In a 2-3 day period we configure Snort in your network. The first day we set it up on your distribution of choice (not counting additional probes). We configure it fully to be able to process network traffic at high speed without dropping frames, set up the MySQL database backend and configure the web interface with statistics capabilities. After that we configure it to reduce the false positives specific to your network environment and explain the interface to you. Contact us for a price quote.

Our Snort course is integrated in our 'Performance Tuning and Advanced Security' course.

To other great OpenSource software

Back to Linux Belgium