Toronto Web Hosting - Snort Intrusion Dection Guide

Snort Modes

***AP*** Seq: 0xF5688DCA  Ack: 0x9DAEF2FC  Win: 0x6330  TcpLen: 20

AF CE 60 CB 79 06 BB 3D 58 72 76 F2 51 0F C1 9A  .. .y..=Xrv.Q...

22 5A E3 27 49 F8 A5 00 1B 5A 4F 24 12 0F BF 70  "Z. I....ZO$...p

B7 81 A0 0C F9 EB 83 D1 33 EB C1 5A 2A E6 2E 4B  ........3..Z*..K

F1 98 FB 5A A9 C7 C3 92 78 B1 35 FF F7 59 CF B3  ...Z....x.5..Y..

83 D2 E7 FF 37 F8 34 56 CD 0F 61 62 A9 16 A4 9F  ....7.4V..ab....

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

11/20 16:18:11.133935 192.168.1.100:2474  > 192.168.1.2:22

TCP TTL:128 TOS:0x0 ID:4388 IpLen:20 DgmLen:40 DF

***A**** Seq: 0x9DAEF2FC  Ack: 0xF5688D7A  Win: 0x40F0  TcpLen: 20

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

11/20 16:18:11.134057 192.168.1.2:22  > 192.168.1.100:2474

TCP TTL:64 TOS:0x10 ID:57174 IpLen:20 DgmLen:280 DF

***AP*** Seq: 0xF5688E1A  Ack: 0x9DAEF2FC  Win: 0x6330  TcpLen: 20

A6 CF F9 B5 EA 24 E0 48 34 45 4B 57 5D FF CB B5  .....$.H4EKW]...

D6 C9 B3 26 3C 59 66 2C 55 EE C1 CF 09 AD 3A C2  ...&

74 B6 61 D3 C5 63 ED BD 6F 51 0D 5E 18 44 07 AF  t.a..c..oQ.^.D..

86 D2 8A 3F 82 F0 D2 84 5C A6 7F CC D5 7B 90 56  ...?....\....{.V

93 CF CF 4D DE 03 00 4D E4 4B AD 75 3E 03 71 DC  ...M...M.K.u>.q.

A6 3D 78 DA 01 BF F0 33 46 7D E1 53 B5 62 94 9A  .=x....3F}.S.b..

29 46 56 78 B1 73 C0 3E BB C0 EC 5C 6E D0 E6 BE  )FVx.s.>...\n...

F9 5C 02 90 40 B1 BA 07 F1 96 2F A0 0F 9D E1 3E  .\..@...../....>

8C 3C 40 07 B2 21 28 CA 2D 41 AC 5C 77 C6 D0 3F  .<@..!(. A.\w..?

73 0B 15 32 47 B5 CE E3 FB 83 B3 72 1A B4 64 9F  s..2G......r..d.

6D C7 55 B8 6B DB FC AF 94 8F F3 58 B0 79 CF 14  m.U.k......X.y..

3F 9A FC 32 1D B6 21 B0 4D C3 64 82 C0 62 A8 8C  ?..2..!.M.d..b..

80 C7 4A C8 BA D9 C3 0D 74 86 76 B8 49 8A 94 D1  ..J.....t.v.I...

4C F3 BF AF 55 3B 57 2B EA C7 48 B7 A4 BD B2 20  L...U;W+..H....

4A 66 B4 4E F3 2A 7E B6 F8 63 A8 61 42 F3 85 3B  Jf.N.*~..c.aB..;

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

To display all packet information on the console, use the following command.

This command displays captured data in hexadecimal as well as ASCII format.

[root@conformix snort]# /opt/snort/bin/snort  dev

Initializing Output Plugins!

Log directory = /var/log/snort

Initializing Network Interface eth0

          == Initializing Snort ==

Decoding Ethernet on interface eth0

footer