Making Linux an IPS device using SNORT
cmw.osdude 120000QT77 Comments (2) Visits (32710)
(Written by Ping Lee, Henry Chuang, Charlotte Yaou, Winson Chao, and Gary Hsueh)
To get the most from the article, you should have a basic knowledge of SNORT, Linux and a working Linux system on which you can practice the commands covered in this article. Also you should have some networking knowledge such as TCP/IP, iptables, etc.
What Is IPS (Intrusion Prevention System)?
Intrusion Detection System (IDS) is a device which monitors packets on your network. IDS reports attack behaviors based on security rules and signatures applied on the device. However IDS has certain disadvantages, such as high false positive rate, unable to stop Denial of Service (DoS) attack and intrusion from UDP protocols.
Intrusion Prevention System (IPS), on the other hand, not only has the ability of IDS, but also can drop malicious packets and close connection sessions in order to stop further attacks. IPS could achieve Real-time Interdiction by leveraging in-line deployment in the network topology. It analyzes all network traffic passing through system and takes actions to suspicious packets immediately.
Network deployment method of IDS and IPS
Due to the differences between IDS and IPS, the deployment of these two systems is designed according to their characteristics.
IDS usually plays the role of monitoring. IDS must be able to sniff the traffic which interests IDS while not compromise the overall network throughput. Following figure illustrates the typical way of deploying an IDS device on a network.
On the other hand, IPS must take immediate action to suspicious packets. The deployment need to enable IPS to look at each packet and deal with suspicious packet real-time. Typically making all traffic pass through IPS could achieve the deployment requirement. This is so-called in-line deployment.
SNORT on Linux to Act as an IPS – The Idea behind It
Generally SNORT is sophisticated IDS software, which monitors network traffic to detect and analyze attacking behaviors according to predefined rules. SNORT sends alerts to network administrator while attacks or abnormal network activities are detected. However, the function of the system is limited to passively monitoring party. The protective action must rely on the administrator’s response.
Though SNORT is commonly used as an IDS, it has some enhanced capabilities could make it into an IPS. This article mainly illustrates how SNORT can act as an IPS device.
By using the following settings, SNORT becomes an IPS to take immediate action to suspicious traffics.
The Actual Implementation – Lab Exercise
We are going to implement a basic IPS box step by step in this lab. This box has 2 interfaces acting as one inline segment and is connected between host A and host B. The following figure shows the topology. Moreover, we will play some packets from host A to host B to see if part of them will be dropped as we expect.
Configure and run SNORT in inline mode
Please refer to the following article to see how to install SNORT: http
Add following rule set to /etc
drop tcp any any -> any 23 (msg: "Drop telnet packets"; sid: 1000001) pass ip any any -> any any
config daq_dir: /usr/lib64/daq config daq: nfq config daq_mode: inline config policy_mode: inline output alert_full: stdout include /etc
Run SNORT with the following command line options
$ snort -c /etc
Now, we can send an ICMP Ping packet from host A to host B. The ICMP Ping packets should be forwarded successfully because the ICMP packets are allowed in our SNORT rule set.
winson@VM-UBUNTU:~$ ping 126.96.36.199 -c 1 PING 188.8.131.52 (184.108.40.206) 56(84) bytes of data. 64 bytes from 220.127.116.11: icmp_req=1 ttl=64 time=0.838 ms --- 18.104.22.168 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.83
Then we can use telnet to send TCP packets destinating to port 23 and we should get a connection timed out message.
winson@VM-UBUNTU:~$ telnet 22.214.171.124 Trying 126.96.36.199... telnet: Unable to connect to remote host: Connection timed out
We can also go to SNORT console to see these telnet packets are dropped by SNORT
[**] [1:1000001:0] <> Drop telnet packets [**] [Priority: 0] 05/0
Now it is a Linux box with basic IPS capabilities. You can try to write more complicated SNORT rules to make it more powerful.