problem 2 [60% - 10% for each of 6 snort rules]
There are several distinct packet signatures in the packet trace file. In the trace file, there are 30 packets total. Your task is to create 6 new snort rules that will uniquely identify the 6 different packet signatures. One snort rule is already shown as an ex (i.e., alert icmp any any -> 192.168.10.2 any (msg:"ping detected"; itype:8; sid:999;)). Since you were already provided with the ex snort rule, you need to "comment out" that the ex rule in the csec640.rules file by putting the "#" at the beginning of the line in front of the word "alert". Look though the packet trace to identify the other rules. Look for more general signatures where you can, however, be careful not to prepare signatures that are too general (e.g., no 3 "any"s in a single rule). Part of the intent of the lab is to learn how to prepare effective rules. It is easy to prepare a rule that matches all IP datagrams regardless of content, but this would be a very ineffective rule at detecting anomalous or malicious activity.
Include in your prepare up the 6 additional rules you have created as well as the c:snortbinlogalert.ids output (you may screen-capture the alert output and include it in the report). The alert output file is appended each time snort has output, so you want to erase the alert file by typing
del C :snortbinlogalert.ids before each snort run while experimenting with different rules. Be sure to include a descriptive message ("msg" and "sid:xxx") with each alert. In addition, briefly describe each rule you prepare.
The report should include the following information:
Rule #1:
• Snort alert rule you've created.
alert tcp any any -> 192.168.1.0/24 80 (msg:"SYN FLOOD"; sid:10999;)
• describe how rule #1 works.
• Snort alert output: the result obtained from c:snortbinlogalert.ids by running rule #1.
Rule #2:
• Snort alert rule you've created.
• describe how rule #2 works.
• Snort alert output: the result obtained from c:snortbinlogalert.ids by running rule #2.
Repeat for (Rule #3 - Rule #6)
Please test each rule individually and comment on any previous rules that you have successfully tested. This allows you to test each rule for better troubleshooting.
The rules you prepare may be instructive, but not the most useful for a real system.