Intro
You will use a Network Intrusion Detection System (NIDS) to detect attacks through the network. Our tool of choice is Snort, an open source signature-based NIDS (remind yourself about the differences between anomaly- based and signature-based intrusion detection systems).

Step 1: Install and configure snort
$sudo apt-get install snort

Read the comments in /etc/snort/snort.conf carefully and pay attention to the definition of variable HOME_NET and EXTERNAL_NET. Then try running Snort as root:
$sudo snort -c /etc/snort/snort.conf

Watch the output carefully, and address any errors in your config file. (Hint: some default .rules files contain deprecated format, try to comment those files in the config file). Continue re-running snort until you get it working correctly.

Step 2: Snort also allows us to write custom rules. Open the file /etc/snort/rules/local.rules and add one rule that detects each visit to www.google.com. The rule should look for any outbound TCP traffic that is going to port 80 and contains the pattern "www.google.com" in the URL and trigger an alert when it gets a match. Give the rule an SID of 1000000 or higher. Then visit Google with a web browser (or any other tool of your choice) and check if your rule triggered an alert.

Step 3: On Kali there is netcat tool already available. Familiarize with it, since it is needed for Step 4.

Step 4:
1. Create snort rules for two new "attacks":
1. Any packet that contains the string "Evil packet"
2. Any packet larger than 256 bytes going to port 80.
2. To use your rules
1. Store the rules in a file named /etc/snort/rules/2att.rules
2. Modify /etc/snort/snort.conf to use your rule file.
3. Restart snort so that it rereads its rules.
3. Test your rules using the netcat application available in your Kali. Record both your commands and the alerts that were generated. (check the â€œscriptâ€ command to record you terminal sessions)

Intro You will use a Network Intrusion Detection System (NIDS) to...