Submit your answers to Questions 1-4 below.

Important Reminders:

- Carefully review the packets in the snort.out data file before writing Snort rules

- Each Snort rule should aim to detect anomalous or malicious or suspicious traffic

- Answer each question separately and write the original question before your answer.

- Use screenshots from the lab and additional research sources to support your answers.

- Tip on Screenshots: Contact TA immediately for help with capturing screenshots or any other lab steps.

Question 1

What does each of the flags in this snort command line do? Answer one by one clearly in a list or table format. Document the source of your information as well.

Question 2

There are several distinct packet signatures in the packet trace file (snort.out.pcap). This file contains 30 packets totally. Your task is to create 6 new snort rules, and each rule identifies a different type of packet signatures. (For example, one rule identifies ICMP packets; one rule identifies http packets; etc.) That means one packet cannot be identified by your R1 and also identified by your R2.

However, one protocol (with the same name) is either TCP or UDP, you can write two rules for that type protocol, one for TCP and one for UDP.

You should use Wireshark to open the trace file (snort.out.pcap), exam the type of data packets carefully. Most packets contain suspicious information, and your rules should alert them. Do not write two or more rules on the same type of packets. (For example, do not write two or more rules to alert/log ICMP packets).

You should use contents or flags (or both) in the rule. You are encouraged to define variables.

If the packet is sent to or from a server (service), the service port # should be specified in the rule, For example, if you alert HTTP, the service port 80 should be specified.

One Snort rule is already shown as an example (i.e., alert icmp any any -> 192.168.10.2 any (msg:"ping detected"; itype:8; sid:999;)). You can write another rule to alert ICMP with different itype. Since you were already provided with the example snort rule, you need to "comment out" that the example rule in the csec640.rules file by putting the "#" at the beginning of the line in front of the word "alert".

Look though the packet trace to identify the other rules. Look for more general signatures where you can, however, be careful not to write signatures that are too general (e.g., no 3 "any"s in a single rule). Part of the intent of the lab is to learn how to write effective rules. It is easy to write a rule that matches all TCP or IP datagrams regardless of content, but this would be a very ineffective rule at detecting anomalous or malicious activity.

Include in your answer the 6 additional rules you have created and c:\snort\bin\log\alert.ids output (include the screenshots of the alert output for each rule in your answer). The alert output file is appended each time snort has output, so you want to erase the alert file by typing del C :\snort\bin\log\alert.ids before each snort run while experimenting with different rules. Be sure to include a descriptive message ("msg" and "sid:xxx") with each alert. In addition, briefly explain each rule you write.

Your answers should include the following information in the format given below:

Question 3

The threat expert links above describes Gimmiv.a as:

"....it could technically be classified as a network-aware trojan that employs functionality of a typical RPC DCOM network-aware worm to attack other hosts in the network."

Describe your interpretation of the above quote. Focus on the behavior and explain how the code could impact a network. Explain in a few paragraphs what specific techniques you may use to detect the above threat caused by Gimmiv.a. What snort rule(s) should you use to prevent (or detect) the above threat? You will have to do research to explain your answers sufficiently.

Question 4

You learned a covert channel. Do you think IDS like Snort can easily detect a covert channel? For example, can you write an effective set of Snort rules to prevent any information leak through a covert channel? Explain your answer in detail and support your answer with research and documentation.