- We just introduced a new Snort rule
to detect ping packets,
and it's time to check
if it actually works.
Let's start by running Snort
in its IDS mode.
Type sudo
space
snort
space
- C,
which indicates the location
of the Snort configuration file.
We'll be using the default
Snort configuration file,
which is located at
/etc/snort/snort
.com.
The next option is
- A
console.
Type dash, capital a,
space, console,
which indicates that we'll be displaying
the Snort alert
on our terminal window.
The next option to specify is
- L
space
/var/log/snort,
which tells where the Snort log messages
are going to be stored.
And finally,
we have to say which network interface card
Snort is going to be listening to
by typing
/ -i
space
eth0.
We'll be listening to the external network interface card
of this Ubuntu router host,
which has the IP of 10.0.0.6.
Let's start Snort by pressing enter.
Do you see our new rule working here?
The Snort alert ID we created was
1 million one,
and our message was
ping detected.
Our new Snort rule is working.
Congratulations.
You did it again.