The snort package at http://www.snort.org/ is a powerful intrusion detection package and is included in the Network Security Toolkit distribution. Through a combination of scripts and HTML pages, you can get snort up and running on your network in two mouse clicks once you've reached the WUI.
In order to bring up snort, you will first need to click on the
Snortlink which appears in theNetworkingtable of the WUI. Look at the row labeledIntrusion Dectectionas shown in the following:
To run snort, you then press the big gray button that says
Start Snortas shown in the screen shot below:
That's all there is to it. After two mouse clicks, snort should be starting up on interface
eth0. If things go well, you should be presented with a screen indicating that snort has been started in the background. As the process of starting up snort also requires starting up and initializing the SQL server, it may take a couple of minutes before its fully ready (especially if you are running it on a old laptop like me). If you are impatient, you can click theCheck Statusbutton like a monkey gone mad, until it indicates that snort is ready and running. The initial screen shown (prior to pressing theCheck Statusbutton) resembles:
It should be noted, that we've only looked at starting snort with a minimum number of mouse clicks. A skilled reader will take the time to read the instructions shown on the initial setup page. There you will discover that:
You can change what interface snort uses. A skilled snort user (Ron in my world) prefers to run snort on a dedicated interface.
You can choose to download the most recent set of rules from the Internet instead of using the local copy available on the CD.
You can run more than one instance of snort if your machine has multiple interfaces.
You can specify your own options to snort before it starts.