[Autogenerated] it's time to hop into the lab again
and check out another pre processor.
This is the one that we just talked about the ports can pre processor,
we'll explore the configurations for this then test it out and see it in action.
Let's hop in.
Alright.
We're back in the lab now that we've talked about
the flow ports can pre processor.
Let's go check out those capabilities real quick and then do another
test to show that we can use it with rule sets as well.
So while we're here,
the first thing that I'm going to do is show you the
rules at the bottom about scans.
So let's go explore the snort dot lua file again and
let's look for the flow ports, can inspection settings.
We have a little bit of information up here for pork skin for
the default med pork skin configuration.
And then if we go over to the snort defaults dot lua
and we go close to the bottom.
We have the TCP med ports here which is part of the
configuration for the ports can defaults.
So this whole section here is all about those pork skin defaults and
this is what we're using in our configuration.
So what this does is it defines all of the different variables for
which parameters we want to use to detect ports,
scans or using the TCP main ports.
So the criteria is pretty high to flag this.
Not as bad as the high porch though,
as you can see these are classified between TCP UDP and IP and we have low
medium and high detection capabilities and then we have the different
parameters that tie all of those configurations together.
And if you remember when we're looking at the snort dot lua file,
we were using the default medium ports scan settings.
So this is what we're looking for when we're doing a porch scan
to be able to identify when it's happening.
And so essentially what this flow ports can pre processor does for us.
Like we explained in the slides a little while ago is it ties all of
these detection capabilities together and looks for patterns in the
activity to identify a potential scan.
All right.
So let's tail our alerts dot Jason file so we can see if a poor
scans detected and we'll run our porch scan.
Alright.
And that porch skin worked.
So let's go ahead and exit that.
Now let's look through our logs.
But let's use Kibana to visualize it a little bit better.
So let's get rid of the HTTP alert, search strings and filters refresh that.
Now let's look and see what we have for messages we have ICMP traffic detected.
We have TCP ports can and it looks like that ports can
triggered another rule that we had for telnet.
But let's filter around this ICMP traffic detected.
That's our custom rule that helps us detect ICMP activity but
that's not what we're looking at for our pork skin.
Let's look at the TCP ports can one.
So this was detected using snorts standard configuration for
the default medium ports scan setting.
And as you can see our destination address was our snort box.
The 30.5 that we had our external host.
Do the ports can on.
We have a rule I.
D.
The 1 22 11.
And we have our source address which is outside of our Globomantics network,
the 10.40.
So what snort did was it took all of the packet information that it
collected from this host and used the flow ports can pre processor to
identify patterns in the traffic and understand that one host was
doing a porch scan on another.
Alright now let's talk about application pre processors.