IDS notes

I've been toying around with Snort (IDS) for windows.  Here are some major links.   

'download winpcap
http://www.winpcap.org/install/default.htm

'snort for windows
http://snort.org/dl/binaries/win32/

'Textpad to read snort.conf (notepad doesn't work)
http://www.textpad.com/download/index.html

'download rules place in c:snortrules
http://snort.org/pub-bin/downloads.cgi
1) register first
2) download / extract (The Official Snort Ruleset (registered user release)
3) download / extract Community Rules 

'edit snort.conf
change 3 things
#var RULE_PATH ../rules
var RULE_PATH c:Snortrules

# dynamicpreprocessor directory /usr/local/lib/snort_dynamicpreprocessor/
 dynamicpreprocessor directory c:Snortlibsnort_dynamicpreprocessor

# dynamicengine /usr/local/lib/snort_dynamicengine/libsf_engine.so
 dynamicengine c:Snortlibsnort_dynamicenginesf_engine.dll

'
references
http://thelazyadmin.com/index.php?/archives/121-Running-SNORT-IDS-on-Windows-2003.html

One thought on “IDS notes”

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

%d bloggers like this: