Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

What is the easiest way to test Snort IDS after installing? Would using and writing a rule that captures all of the traffic work?

alert ip any any -> any any ( msg: "ICMP packet detected!"; sid: 1; )

That is, using its own rules.

One way that I know of for testing Snort is by using some programs such as Nmap, Metasploit, and something else, but how can it be done?

share|improve this question
    
ping the snort machine. snort thinks pings are DoS. then check the alert directory. on linux this is, /var/log/squid/ if you are on windows then i dont know... –  16num Jan 15 '13 at 13:00
add comment

3 Answers

up vote 6 down vote accepted

There are two subtly different things you might want to test.

  1. Is Snort working in the sense that it's running, able to sniff trafic, testing it against the rules, and alerting you when one is triggered?
  2. Is Snort working in the sense that it's current rule set detects a specific intrusion of type X?

To test case 1, you make a rule that's easy to fire, like your example, and fire it. To test case 2, you have to attempt an intrusion of type X and confirm that it is detected.

You seem to be wanting to test case 1 (that the install has been done correctly) using the method in case 2, but you don't need to. Using a "fake" rule is a perfectly valid test that Snort is working in the first sense. And it's easier. Easy tests are good. You don't want to faff around with Metasploit when you're just checking that the alert emails go to the right person. Especially if you're not skilled in running intrusions - what if you do the intrusion wrong, and get a false test result? What if the intrusion attempt crashes the target (which is very likely on many types of intrusion.)

You really only need to test case 2, that a specific rule works against a real intrusion attempt, if you don't trust your rule set (in which case - why are you using it?) or if you're developing new rules.

share|improve this answer
    
I say "like your example" but your actual example is not a good test rule to set up. Something like "alert me if you see port 80 web traffic coming into this host" will be much easier to control. You want to be able to make the rule fire on command, so you can test, adjust settings, and test again. Something that's firing all the time will be too noisy. –  Graham Hill May 22 '12 at 8:30
    
May i ask you give a detailed example?!! –  Mohsen Gh. May 23 '12 at 9:51
1  
If you have a host at 192.168.1.1 then this rule will detect any attempt to ping it: alert icmp any any -> 192.168.1.1 any (msg: "Someone Pinged DotOne";) –  Graham Hill May 23 '12 at 17:30
    
Yes i know this. I do that!! But my question is how to use those programs to test Snort's rules(default rules i mean)? –  Mohsen Gh. May 24 '12 at 6:28
    
To test a specific existing rule, you have to attempt the intrusion it protects against: but as I mention, you should not normally need to do that. –  Graham Hill May 25 '12 at 11:02
add comment

It also might be worth taking a look at IDSWakeUp.

IDSwakeup is a collection of tools that allows to test network intrusion detection systems.

The main goal of IDSwakeup is to generate false attack that mimic well known ones, in order to see if NIDS detects them and generates false positives.

Like nidsbench, IDSwakeup is being published in the hopes that a more precise testing methodology might be applied to network intrusion detection, which is still a black art at best.

share|improve this answer
    
It's good idea, and working well. Thanks. –  Mohsen Gh. Jul 26 '13 at 9:06
add comment

To test that your default rules are working, assuming you've pulled them down with pulledpork, oinkmaster or something-else, you can simply browse to http://testmyids.com/ from a client whose traffic will be seen by the IDS, through your IDS device being inline or as a port span.

The http response contains the following text -

uid=0(root) gid=0(root) groups=0(root)

which will match one of the default snort rules that looks for "content" containing root. This is an old rule to check for successful privilege escalation when an attacker runs the "id" or "whoami" type commands to check that he/she has root access.

Here's an (old) blog also discussing how to test snort - http://global-security.blogspot.com/2008/01/how-do-i-know-if-my-snort.html.

share|improve this answer
    
testmyids.com is canonical. You can also play packet captures of known events into your system to see if snort alerts. There are many such captures included in the SecurityOnion distribution or available from various online resources. –  adric Aug 1 '13 at 17:04
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.