Intrusion Detection
91
Advanced Intrusion Detection configuration
Figure 7-2
Check
Enabled
, and select the
Interface
/network port to monitor. This will typically be
Internet
, or possibly
DMZ
.
Checking
Use less memory
will result in slower signature detection throughput, but may
be necessary if your SnapGear appliance is configured to run many services or many
VPN tunnels.
Next the
Rule sets
, of which there are more than forty, need to be selected. They are
grouped by type such as DDOS, exploit, backdoor, NETBIOS, etc. Each type in turn has
many subtypes depending on the exact attack signature.
For example, selecting
NETBIOS
will enable matching subtype signatures for
NETBIOS
winreg access
and
NETBIOS Startup Folder access attempt
, etc. The subtypes or
signatures themselves however are not displayed on the SnapGear Management
Console.
The full subtype signatures can be viewed at Snort web site. Included is detailed
information such as signature, impact, operating systems affected, attack scenarios, ease
of attack, corrective action. There are thousands of these in the Snort signature
database:
http://www.snort.org/cgi-bin/done.cgi
