- [Instructor] Let's run Snort
as an intrusion detection system.
Before we put Snort in its intrusion detection mode,
we have to do some prep work.
First, we'll introduce a new Snort rule
by creating a file.
Let's go to /etc/snort/rules
by typing cd /etc/snort/rules/.
Press Enter.
We'll create our rule file called my.rules.
Type sudo nano
my.rules.
Press Enter.
The new rule we're creating
will detect any ping attempts
to the interface we want to monitor.
Type alert.
Meaning whenever there is a ping attempt,
send an alert.
Space, the next thing to type
is a protocol to detect.
Ping uses the Internet Control Message Protocol or ICMP.
Therefore, type icmp space.
We don't care where the ping message is coming from.
It could be any IP address or any port number.
That's why we type any space any
in terms of where the packet is coming from.
Any
space
any space.
Type a dash
and a greater than sign,
space, to indicate the destination.
We want to detect every ICMP message.
Therefore, the destination IP
and the destination port number are any and any too.
Space any.
Next, open a parentheses.
Type msg:
space to indicate the start of the alert message.
The message will say ping detected.
Ping detected.
And then exclamation
and then type a semicolon.
The last step is assigning an ID to the alert.
It's 1,000,001, which is a number I picked arbitrarily.
Type sid:1000001.
Sid here stands for Snort Rule ID.
Don't forget another semicolon here at the end
because if you miss it, you'll get an error.
Close parentheses.
Now we're done with creating our rule,
let's save the file by pressing Control and X together.
Type Y, press Enter.
For Snort to be able to use this new rule file,
we have to make the Snort configuration file refer
to the new rule file.
To do that, let's go to /etc/snort.
Type cd .. to go up one level.
Press Enter.
Type ls, press Enter.
Do you see the snort.conf file?
Let's edit it.
Type sudo nano
snort.conf.
Press Enter.
Let's look for the area
where the rule file locations are specified.
Add a line to refer to the new rule right here.
Type include space
RULE_PATH/
and then the name of the rule file,
which is my.rules.
Save the file by pressing Control and X together.
Type Y.
Press Enter to accept the current file name.
Now we're ready to run Snort
to use our newly created rule file.