Snort的前端界面——IDScenter的介绍.ppt

Snort IDScenter 60-564: Security and Privacy on the Internet Instructor: Dr. A. K. Aggarwal Presented By: Tarik El Amsy, Lihua Duan Date: March 29, 2006 What is IDScenter IDScenter is basically a Graphical front-end for Snort on Windows platforms (Recommended: Windows NT4/2000/XP). IDScenter provides a friendly interface for Snort users. With some knowledge of Snort, IDScenter will help users to do configuration and provide management features. Features of IDScenter Snort 1.7, 1.8, 1.9, and 2.x Support Snort configuration wizard Online updates of IDS rules Ruleset editor for all Snort rule options HTML report from SQL backend Execution of program on attack detection Good Alerting tools including mail , Windows event log and normal DB logging. Experiment Architecture and Scenarios NIDS server configuration CPU: AMD64 Opteron Memory: 512M Hard Disk: 8 G Operating Operating System: Windows 2000 Advanced Server (Ser) IP Address: Installed Software: Snort 2.4.3 IDScenter 1.1 RC4 WinPcap 3.1 Ethereal 0.10.14 Target server configuration CPU: AMD64 Opteron Memory: 512MHard Disk: 8 G Operating System: Windows 2000 Advanced Server (Ser) IP Address: Installed software Ethereal 0.10.14 Winpcap 3.0 alpha 4 Packet Excalibur 1.0.2 (Packet generator) Web server, TelNET, SNMP, FTP, etc Attacker server configuration CPU: AMD64 Opteron Memory: 512MHard Disk: 8 G OS: Windows 2000 AS IP Address: 52 Installed software Winpcap 3.0 alpha 4 Packet Excalibur 1.0.2 (Packet generator) Web server, TelNET, SNMP, FTP, etc. Installing WinPcap WinPcap (Windows Packet Capture Library) is a packet-capture driver. Functionally, this means that WinPcap grabs packets from the network wire and pitches them to Snort, ethereal and windump. Download run WinPcap_3_1_auto-installer.exe to local disk from /install/default.htm Should be installed on hosts Installing Ethereal Ethereal? is used by network professionals around the world for troubleshooting, analysis, software and prot