Vulnerability scanner tools to use with Snort

Question

We plan to add Snort with the firewall for our network to have improved security. The purpose, apart from protection from malicious traffic, is to customize Snort to detect and block specific traffic as per our needs. So basically i will be writing rules for Snort for our specific needs. But before beginning all that, i need to use a vulnerability scanner tool- to know the vulnerabilities which are not being detected presently by the Snort-firewall combo, and then i can start writing rules for Snort for those vulnerabilities. Given my situation, can i have suggestions for the right tool - I know but a few names like Nessus, Metaslpoit, OpenVAS, nmap....

Answer 1

Just download the Backtrack 5 distro (http://www.backtrack-linux.org/downloads/) as it's free and comes with Nmap, Nessus, Metasploit, Openvas and much more. IMHO, nmap is the best scanner but everyone has their own preference. Metasploit has some nice integration with nmap

Out of the box Snort will detect a lot of the default scans because the packets sent have a signature/form that's been out there for years and so is well-known.

Additionally, there's so much scanning these days on the net that people (rightly or wrongly) generally ignore such noise on the firewalls or ids/ips systems.

You'd be better going the extra step and seeing what you can detect or do post the scanning phase (assuming you have permission to launch further attacks/testing). A vulnerability scanner isn't going to necessarily tell you what attacks are possible, only what vulnerabilities it feels your systems have (and these may be false-positive).

Answer 2

I would not try to implement snort to detect scanners. You need to implement snort to detect attacks and probes against your assets. Without knowing what you plan to protect, you cannot write good rules. Detecting a scan for say tooltalk, when you don't even run it is only going to tell you, someone is running a poorly configured vuln scanner.