The first network intrusion detection system software that we're going to look at is one of the older
ones that's been around for a while and it's north.
So snort is an open source piece of software, but there's also a commercial version that is available
as well.
We've got Snort, which is the open source, and it will run on both windows as well as UNIX like operating
systems like Linux or MAC OS.
And there are a couple of components to it.
The first thing is just the intrusion detection system itself, the software.
So the other component is the set of rules.
What we've got here, as you can see, are the rule sets that are potentially available.
There's a couple of different ways of handling rules.
One of the ways that you can handle rules is just to download the rules here and then install them to
the IDS system that you've got in place or whatever that happens to be.
And we're going to install that here shortly.
The problem is that the rules are being updated fairly regularly.
And so what you can do is you can keep downloading the rules if you want or you can install a rule manager.
For example, you could install Wink Master and we'll take a look at Linkmaster in a little bit.
But you could use one of those automated grab the latest rules.
That's pieces of software to keep your rules up to date.
So I'm going to do here is I'm just going to do app dash jet install snort and I'm going to do this
on an Ubuntu system.
There are some Linux distributions that do include snort packages, others that don't include snort
packages.
You could also install it on free BSD, for example.
What we've got for install packages are we've got some of the prerequisite pieces of software, the
dependencies and we've also got, as you can see, it's going to install wink master for us.
So it's going to install the rules manager on our behalf.
It's also going to install some default snort rules.
So there's the package here for default snort rules.
Now, of course, it's also going to install snort, snort comments and libraries as well.
So we've got the entire set of packages.
It's going to do some basic configuration for us.
And what I want to do here is I'm actually going to just open up another terminal here and make sure
that the interface is 88 zero.
It's actually not.
It's as 33 on this particular system, pretty commonly on a Linux system, you're going to get it eight
zero.
This is actually a virtual machine because it's a virtual machine.
What it is installed for a network interface for Zendesk 33 Now it's going to ask me for the range of
the local network, and this happens to be my local network.
So it's done some very basic configuration for us.
And again, it's going to ask me what interface it should be listening on once it's configured snort.
So now we've got snort installed at this point and we can start looking a little bit more closely at
the configuration settings.
And we'll also take a look at the rules and how to keep those updated.
And we'll do that coming up.