Download
1 / 7
70 likes | 198 Views
Network-based Intrusion Detection and Prevention. Yinzhi Cao Hongyu Gao Yue Liu. Workflow. iptable gets network traffic iptable redirect traffic to NIPS NIPS does rule matching malicious traffic is dropped, while good traffic is accepted. Overview.
E N D
Network-based Intrusion Detection and Prevention Yinzhi Cao Hongyu Gao Yue Liu
Workflow • iptable gets network traffic • iptable redirect traffic to NIPS • NIPS does rule matching • malicious traffic is dropped, while good traffic is accepted
Overview • We establish the VM environment from ICTF 2007 and install snort on the VM machine. • We successfully redirect packages from iptables to snort_inline and use nc to see it indeed works. • We also do some research on snort rules.
VM environment • Establish the VM Environment • Because we don't know their main Box IP, what we have already done is mainly based on image box and vulnerable box.
Install Snort on VM machine • We run 'modprobe ip_queue' to start iptable's queue mode. • We use 'iptables ‐I INPUT ‐j QUEUE' to let packages go to snort
Download and Modify Snort Rules • We download snort rules from snort websites. • We add Metasploit payload into snort rules to make Metasploit not work.
