Snorting up intrusion detection

To learn more about keeping our network from being compromised, we subscribed to a security mailing list. We have read about the Snort intrusion-detection system. Can we run it on a Windows system and use it to monitor the network?

Yes, Snort can run on a Windows system. The Snort home page (https://www.snort.org/) even lets you download a pre-compiled Windows version so you don’t have to compile the program from source code.

You should also get a copy of the Snort Users Manual and a copy of the Windows Guide, which explains the need to install a packet capture driver before installing Snort. You can use winpcap (https://winpcap.polito.it/)  or packet2k (https://packetstormsecurity.nl/sniffers/windump/) to do this.

Snort operates in three modes. You can use it as a sniffer that displays all network traffic on your screen, and as a packet logger, which writes copies of the packets to a file on your disk drive. The third way, network intrusion detection, is covered in the user manual. In this mode, Snort uses a rules file (snort.conf) to decide which packets represent intrusion attempts.

Writing Snort rules is explained in detail on the snort.org Web site.