Snort on Stealth Interface Snort with no IP Address Interface

References 21 • Enable TCPIP on the network interface that you want to use in the stealth mode. Disable everything other than TCPIP. • Enable DHCP client. • Disable DHCP service. This will cause no address to be assigned to the interface while the interface is still bound to TCPIP networking.

1.8 References

1. Intrusion detection FAQ at http:www.sans.orgnewlookresourcesIDFAQ

ID_FAQ.htm

2. Honey Pot Project at http:project.honeynet.org 3. Snort FAQ at http:www.snort.orgdocsfaq.html

4. Honeyd Honey Pot at http:www.citi.umich.eduuprovoshoneyd 5. Winpcap at http:winpcap.polito.it

6. Cisco systems at http:www.cisco.com 7. Checkpoint web site at http:www.checkpoint.com

8. Netscreen at http:www.netscreen.com 9. Netfilter at http:www.netfilter.org

10. Snort at http:www.snort.org 11. The Nmap tool at http:www.nmap.org

12. Nessus at http:www.nessus.org 13. MySQL database at http:www.mysql.org

14. ACID at http:www.cert.orgkbacid 15. Apache web server at http:www.apache.org

23 C H A P T E R 2 Installing Snort and Getting Started Snort installation may consist of only a working Snort daemon or of a complete Snort system with many other tools. If you install only Snort, you can capture intrusion data in text or binary files and then view these files later on with the help of a text editor or some other tool like Barnyard, which will be explained later in this book. With this simple installation you can also send alert data to an SNMP manager, like HP OpenView or OpenNMS, in the form of SNMP traps. Alert data can also be sent to a Microsoft Windows machine in the form of SMB pop-up win- dows. However, if you install other tools, you can perform more sophisti- cated operations on the intrusion data, such as logging Snort data to a database and analyzing it through a web interface. Using the web inter- face, you can view all alerts generated by Snort. The analysis tools allow you to make sense of the captured data instead of spending lots of time with Snort log files. Other tools that can be used with Snort are listed below. Each of them has a specific task. A comprehensive working Snort system utilizes these tools to provide a web-based user interface with a backend database. • MySQL is used with Snort to log alert data. Other databases like Ora- cle can also be used but MySQL is the most popular database with Snort. In fact, any ODBC-compliant database can be used with Snort. A