- [Instructor] Although, Snort is an intrusion detection
and prevention systems solution,
it can also be used as a basic packet sniffer.
let's start by first installing Snort.
Type sudo, space, apt, get, install, space, snort.
Press Enter.
Type Y and press Enter.
The address range for the local network is
10 dot, zero dot, zero dot, zero, forward slash 24.
Forward slash 24, indicates that, 10 dot zero dot zero
is the subnet ID for the network to monitor.
Press Tab to select OK and press Enter.
Now, we have our snort instance installed successfully.
To start capturing packets type sudo, space, snort,
space, dash i standing for interface.
Which interface do we use to sniff the packets here?
We'll be using it is zero,
which is the first network interface
of the Ubuntu router host.
Space, E-T-H zero.
Space dash L and then the location
where the packets are going to be locked.
Here, dash L stands for logging.
We'll be logging the packets in a particular location,
namely, var log snort.
So type, space forward slash var, forward slash log,
forward slash snort.
We're going to be storing the results of packet sniffing
in a binary format,
which is why now we're typing dash B here.
So space, dash B, press Enter.
Now the snort application is up and running.
Let's give it a little bit of time
so that we can capture some packets.
To stop capturing, press Control + C together
and let's go to the directory,
where the packets are captured.
Type C-D, space, var, log, snort.
Press Enter.
Type ls, press Enter.
There are three log files here,
and we're going to be opening up the last one.
Type sudo, space more, space snort, dot log, dot one six,
and here press Tab to complete the command.
Press Enter.
We're getting weird results here because it's a binary file
and we cannot read it in a text viewer.
What do we do to actually read the content properly?
Type Q to get out of this,
and we'll be using Wireshark
to view the packet captured by Snort.
Type sudo, space Wireshark,
and then the name of the file, snort, log, press Enter.
Now, you can read the individual entries of the results
of our packet capturing.
Packet capturing is the most basic Snort mode,
and we tried it to get familiar with
how to run snort in general and to see what it looks like
when Snort is running.