Running Snort in Stealth Mode

71

    debug level = 0

    load printers = yes

[homes]

    comment = Home Directories

    browseable = yes

    writable = yes

    available = yes

    public = yes

    only user = no

[htmldir]

    comment = html stuff

    path = /home/httpd/html

    public = yes

    writable = yes

    printable = no

    write list = rehman

[virtualhosting]

    comment = html stuff

    path = /usr/virt_web

    public = yes

    writable = yes

    printable = no

    write list = rehman

[printers]

[netlogon]

    available = no

More information about SMB alerts will be presented in later chapters. Note that

you should compile Snort with   with smbalerts option in the configure script if

you want to use this option. Without  this option in the configure script, SAMBA ser 

vices can't be used with Snort.

2.9 Running Snort in Stealth Mode

Sometimes you may want to run Snort in stealth mode. In stealth mode, other hosts are

not able to detect the presence of the Snort machine. In other words, the Snort machine

is not visible to intruders or other people. There are multiple ways to run Snort in stealth

mode. One of these methods is to run Snort on a network interface where no IP address

is assigned. Running Snort on a network interface without an IP address is feasible in

the following two cases:

1. A stand alone Snort sensor with only one network adapter.

2. A Snort sensor with two network adapters: one to access the sensor from an

isolated network and the other one connected to the public network and running