๐ฟ๐๐ฉ๐๐๐ฉ ๐ฉโ๐ดโ๐ธโ, ๐ตโ๐ฎโ๐ณโ๐ฌโ ๐๐ฉ๐... ๐ช๐จ๐๐ฃ๐ ๐ธโ๐ณโ๐ดโ๐ทโ๐นโ
Snort is a packet sniffer that monitors network traffic in real time, scrutinizing each packet closely to detect a dangerous payload or suspicious anomalies.
My OS :- ubuntu
Let my ip address be 192.168.1.103
๐ ข๐ ๐ ฃ๐ ค๐ :- ( will be easy in future )
First you need to make some changes in configuration of snort.
๐๐๐๐ ๐๐๐๐๐ /๐๐๐/๐๐๐๐๐/๐๐๐๐๐.๐๐๐๐
Now, change HOME_NET IP address to your ip range.
Like,
๐๐๐๐๐ ๐ท๐พ๐ผ๐ด_๐ฝ๐ด๐ ๐ท๐ฟ๐ธ.๐ท๐ผ๐พ.๐ท.๐ถ/๐ธ๐บ
Now go to
/๐๐๐/๐๐๐๐๐/๐๐๐๐๐/๐๐๐๐๐.๐๐๐๐๐
and add the rules given below
( Watch rules writing in the image. )
๐ ๐ ๐ ฃ๐ ๐ ๐ ฃ ๐ ๐ ๐ ๐ ๐ ข๐ ๐ ๐
๐๐ช๐ก๐:-
๐๐๐๐๐ ๐๐๐๐ ๐๐๐ข ๐๐๐ข -> $๐ท๐พ๐ผ๐ด_๐ฝ๐ด๐ ๐๐๐ข (๐๐๐:"๐ฟ๐๐๐ ๐๐๐๐๐๐๐๐"; ๐๐๐:๐ท๐ถ๐ถ๐ถ๐ถ๐ถ๐ท; ๐๐๐:๐ท; ๐๐๐๐๐๐๐ข๐๐:๐๐๐๐-๐๐๐๐๐;)
alert ---> show alert
ICMP ---> It's a protocol used to report error in ipv4
-> :- to
$HOME_NET ---> destination ip
msg ---> shows message which you write
sid ---> ย keyword is used to uniquely identify Snort rules. This information allows output plugins to identify rules easily.
100 - 1,000,000 Rules already registered . So u need to use greater than this id like 1,000,123.
rev ---> ย keyword is used to uniquely identify revisions of Snort rules
classtype:icmp-eventย ---> Categorizes the rule as an โicmp-eventโ, one of the predefined Snort categories. This option helps with rule organization.
๐ฟ๐๐ฉ๐๐๐ฉ๐๐ฃ๐
๐๐๐๐ ๐๐๐๐๐ -๐ฐ ๐๐๐๐๐๐๐ -๐ -๐ /๐๐๐/๐๐๐๐๐/๐๐๐๐๐.๐๐๐๐ -๐ ๐๐๐๐ถ
-A console ----> shows standard output alert
-q ----> quite mode
-i ----> interface
-c ----> config
๐ ๐ ๐ ฃ๐ ๐ ๐ ฃ ๐ ฃ๐ ๐ ๐ ข๐ ๐ ๐
๐๐ช๐ก๐:-
๐๐๐๐๐ ๐๐๐ ๐๐๐ข ๐๐๐ข -> $๐ท๐พ๐ผ๐ด_๐ฝ๐ด๐ ๐๐๐ข (๐๐๐: "๐๐ฒ๐ฟ ๐๐๐๐ ๐ณ๐๐๐๐๐๐๐"; ๐๐๐:๐ท๐ถ๐ถ๐ถ๐ถ๐ถ๐ถ๐ป; ๐๐๐:๐ธ; )
๐ ๐ ๐ ฃ๐ ๐ ๐ ฃ ๐ ๐ ๐ ข ๐ ๐ ฃ๐ ฃ๐ ๐ ๐
๐๐ช๐ก๐:-
๐๐๐๐๐ ๐๐๐ ๐๐๐ข ๐๐๐ข -> $๐ท๐พ๐ผ๐ด๐ฝ๐ด๐ ๐พ๐ถ (๐๐๐๐๐: ๐; ๐๐๐:"๐ฟ๐๐๐๐๐๐๐ ๐ณ๐๐ ๐ฐ๐๐๐๐๐ ๐๐ข๐๐ : ๐๐๐ฝ ๐๐๐๐๐"; ๐๐๐๐ :๐๐๐๐๐๐๐๐๐; ๐๐๐:๐น; ๐๐๐๐๐๐๐๐๐๐๐๐๐๐๐:๐๐๐๐๐ ๐๐ข_๐๐๐, ๐๐๐๐๐ ๐ธ๐ถ, ๐๐๐๐๐๐๐ ๐ท๐ถ;)
reference__researchgate-website
And from google
๐๐ญ๐ฉ๐ง๐
Ping scan :- nmap 192.168.1.103
Tcp scan :- nmap -sT 192.168.1.103
Dos :- Use any tools๐
Contact me via telegram :- I am groot [ @Etf_Zan ]
Top comments (0)