Snort

• What is Snort?

  • What can it do: detect and respond
  • Open source and business.
  • The main Web site for Snort.

• Downloading

  • Download WinPcap (if you installed Wireshark you already have it)
  • Download Snort for Windows or Linux

• Install and setup

  • Install WinCap, then Snort, by double-clicking in the downloaded files. Snort is installed in c:\snort and snort.exe is in the c:\snort\bin directory.
  • Create a login in the Snort Web account signup page and login.
  • Go to the Download rules page and download under Sourcefire VRT Certified Rules - The Official Snort Ruleset (registered user release) the CURRENT file. It will look like: snortrules-snapshot-CURRENT.tar.gz
  • Extract this file to the directory c:\snort and both signatures (under doc) and rules (under rules) will be created.

Previous slide

Next slide

Back to first slide

View graphic version