Preventing Attacks Using Snort: A Step-by-Step Guide

As cyber attacks are becoming more sophisticated every day, we need powerful tools to protect our network security. At this point, Snort offers an indispensable solution for us.

Snort is an open source Intrusion Detection and Prevention System (IDS/IPS) that analyses our network traffic in real time to identify and block potential threats. Compared to alternatives such as Suricata, Snort’s flexible rule structure and broad community support stand out.

In this guide, we will explain step by step how to effectively install, configure and manage Snort. We will also examine in detail how we can strengthen our system by writing custom Snort rules.

Basics of Snort IPS System

To understand Snort, which stands out among network security solutions today, we first need to examine its basic building blocks. In this section, we will discuss Snort’s working principles and architecture in detail.

Differences Between IDS and IPS Systems

To understand security systems, it is important to know the basic differences between IDS and IPS. These two systems are separated as follows:

Operating Principles of Snort

Snort works by analysing network traffic in real time. Our system performs a detailed traffic analysis on IP networks by examining packets. Especially noteworthy feature is its rule-signature based working principle.

Snort’s modes of operation:

• Package Tracker Mode
• Package Logging Mode
• Network Intrusion Detection/ Prevention System Mode

Components of Snort Architecture

The Snort architecture consists of three basic components that work in harmony with each other. Thanks to these components, we can effectively detect and prevent attacks:

1. Packet Decoder: Captures network packets and prepares them for analysis
2. Detection Engine: Identifies attack types by analysing packets
3. Alarm Subsystem: Takes determined actions against detected threats

The most important feature of this architecture is its fast adaptation to new threats thanks to its modular structure. The detection engine operates with high performance and provides real-time protection, especially thanks to rule optimisation.

Snort Installation and Configuration

Before starting the installation of Snort, we need to prepare our system. In this section, we will discuss the installation process step by step and examine the configuration details.

System Requirements and Installation Steps

Before installing Snort, we must make sure that our system meets the following requirements:

For installation, we first need to install the necessary packages:

apt install build-essential libpcap-dev libpcre3-dev libnet1-dev

Basic Configuration Files

Snort’s main configuration file is /etc/snort/snort.conf. In this file, we must configure the following basic settings:

• HOME_NET variable: Defines the network we want to protect
• EXTERNAL_NET: Specifies the external network
• RULE_PATH: Indicates the location of the rule files

We must be careful when editing the dynamicrules section in the configuration file. In particular, we prefer to initially disable rules other than local.rules.

Initial Start-up and Testing

To test the installation, we follow these steps:

1. Let’s check the configuration file:

snort -c /etc/snort/snort.conf -T

2. Let’s see the service status:

systemctl status snort

It is useful to use verbose mode when running Snort for the first time. In this way, we can instantly observe how the system reacts. We also keep log files in the /var/log/snort directory and check them regularly. For detailed information about Linux commands, you can review our Linux Commands Guide content.

Effective Rule Writing Strategies

Being able to write effective Snort rules is critical to the success of our security system. Let’s explore the subtleties of rule writing together.

Rule Syntax and Structure

We can summarise the basic structure of Snort rules as follows:

Special Rule Examples

We can write some examples of effective rules against the threats we face daily:

alert tcp any any -> $HOME_NET 22 (msg:"SSH Bağlantı Denemesi"; 
content:"SSH-2.0"; flow:to_server; sid:100003; rev:1;)

In this rule we specify the direction of traffic using the flow parameter. Similarly, to monitor web traffic:

alert tcp any any -> any any (content:"www.cyberskillshub.com"; 
msg:"CyberSkillsHub Ziyareti Tespit Edildi"; sid:100006; rev:1;)

Rule Optimisation Tips

To improve the performance of our rules, we should pay attention to some important points:

1. Content Matching Strategies:
   • We limit the search area using the Depth parameter
   • We optimise pattern matching with the Within option
   • We examine raw packet data using Rawbytes
2. Preprocessor Integration:
   • For fragmented packages we use the frag2 module
   • For HTTP traffic we use the http_decode property
   • We enable the sfPortscan preprocessor for port scan detection

When writing our rules, we pay attention to the efficient use of the Boyer-Moore pattern matching algorithm. Especially content option, we take case sensitivity into account and avoid unnecessary pattern searches.

Preventing Real World Attacks

To put theoretical knowledge into practice, let’s examine how to use Snort against real-world attacks. To protect our system, we need to develop specific strategies for different types of attacks.

Protection Against DDoS Attacks

In order to use Snort effectively in combating DDoS attacks, we activate the rate limiting feature. We configure our system as follows:

rate_filter gen_id 1, sig_id 1000, track by_src, count 100, seconds 1, \
new_action drop, timeout 300

We also distribute the load by integrating with load balancer systems. We also provide protection against SYN flood attacks by activating the Syncookie feature.

Preventing SQL Injection Attacks

We set up our defence line against SQL injection attacks as follows:

We configure our Snort rules to detect SQL injection patterns:

alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 3306 \
(msg:"SQL Injection Attempt"; content:"%27"; sid:1000001;)

Defence Against Zero-day Vulnerabilities

We use behavioural analysis methods against zero-day attacks. We detect abnormal activities by activating Snort’s machine learning supported modules. Our important layers of defence:

1. Early Warning System
   • Anomaly detection
   • Traffic analysis
   • Pattern matching
2. Proactive Measures
   • Honeypot integration
   • Regular security updates
   • Backup strategies

We monitor suspicious activities in real time using Snort’s preprocessors. Especially with the sfportscan preprocessor, we detect port scanning activities and have the chance to intervene early.

Conclusion

In the cyber security world, Snort proves to be an indispensable tool with its powerful features and flexible structure. This system, which provides a wide range of protection from installation to rule writing, DDoS attacks to zero-day vulnerabilities, takes our network security to the next level.

Snort‘s real power lies in its customisable rule structure and community support. By keeping our system constantly updated, we can always be prepared for new threats. In particular, the effective use of preprocessors and behavioural analysis features allows us to create a proactive line of defence against attacks.

A successful Snort installation and configuration requires continuous monitoring and optimisation. By regularly reviewing our rules, we can optimise the performance and security level of our system. Thus, we are always one step ahead against modern cyber threats.

Frequently Asked Questions About Snort