24

Chapter 2     Installing Snort and Getting Started

  Apache acts as a web server.

  PHP is used as an interface between the web server and MySQL data 

base.

  ACID is a PHP package that is used to view and analyze Snort data

using a web browser.

  GD library is used by ACID to create graphs.

  PHPLOT is used to present data in graphic format on the web pages

used in ACID. GD library must be working correctly to use PHPLOT.

  ADODB is used by ACID to connect to MySQL database.

2.1 Snort Installation Scenarios

Typical Snort installations may vary depending upon the environment where you are

installing it. Some of the typical installation schemes are listed below for your refer 

ence. You can select one of these depending on the type of network you have.

2.1.1

Test Installation

A simple Snort installation consists of a single Snort sensor. Snort logs data to text

files. These log files can then be viewed later on by the Snort administrator. This

arrangement is suitable only for test environments because the cost of data analysis is

very high in the production environment. To install Snort for this purpose, you can get a

pre compiled version from http://www.snort.org and install it on your system. For

RedHat Linux, you can download the RPM package. For Microsoft Windows systems,

download executables and install on your system.

2.1.2

Single Sensor Production IDS

A production installation of Snort with only one sensor is suitable for small net 

works with only one Internet connection. Putting the sensor behind a router or firewall

will enable you to detect the activity of intruders into the system. However, if you are

really interested in scanning all Internet traffic, you can put the sensor outside the fire 

wall as well.

In this installation, you can either download a precompiled version of Snort from

its web site (http://www.snort.org) or compile it yourself from the source code. You

should compile the source code yourself only if you need some feature which is not

available in the precompiled versions. The compilation process for Snort is discussed in

detail in this chapter.