I've been toying around with Snort (IDS) for windows. Here are some major links.
'download winpcap
http://www.winpcap.org/install/default.htm
'snort for windows
http://snort.org/dl/binaries/win32/
'Textpad to read snort.conf (notepad doesn't work)
http://www.textpad.com/download/index.html
'download rules place in c:snortrules
http://snort.org/pub-bin/downloads.cgi
1) register first
2) download / extract (The Official Snort Ruleset (registered user release)
3) download / extract Community Rules
'edit snort.conf
change 3 things
#var RULE_PATH ../rules
var RULE_PATH c:Snortrules
# dynamicpreprocessor directory /usr/local/lib/snort_dynamicpreprocessor/
dynamicpreprocessor directory c:Snortlibsnort_dynamicpreprocessor
# dynamicengine /usr/local/lib/snort_dynamicengine/libsf_engine.so
dynamicengine c:Snortlibsnort_dynamicenginesf_engine.dll
'
references
http://thelazyadmin.com/index.php?/archives/121-Running-SNORT-IDS-on-Windows-2003.html
thanks for the tip !!
LikeLike