write a custom Snort rule to handle Inbound and Outbound HTTP traffic on the Private (Host-Only) network. Upload a screen shot of the Snort console displaying the alerts. In this exercise, we are going to create two Snort monitoring rules that will be used to alert on HTTP network traffic for both Inbound and Outbound traffic. Remember, Inbound rules are those rules whose destination is to your internal network (HOME_NET), outbound rules are directed out of your internal network (!HOME_NET). When you use “any” there is no distinction on whether a rule is Inbound or Outbound. When using Inbound/Outbound to describe local traffic, traffic generated on the same network (as in this lab on VMnet-1), the Inbound reference is to your client system that is running snort the Outbound reference is to the HTTP server. You should now understand a little bit about custom rules, so given the following rule: alert tcp any any -> any 80 (msg:"TCP HTTP Testing Rule"; sid:1000004;) You should be able to determine that it will alert on “any” client messages destined for “any” HTTP server using port 80. In this exercise, you will write two rules, which will result in the following output being displayed in the figure below: To perform this exercise, you will do the following: 1. Create an Inbound HTTP rule for all clients to all servers 2. Create an Outbound HTTP rule for all servers to all clients 3. Use the exact alert message as listed in the figure above a. "TCP HTTP Inbound (from server) Testing Rule" b. "TCP HTTP outbound (from client) Testing Rule" 4. Apply these rules to the local.rules file 5. Startup your DSL server (configured for the VMNet1 adapter) and enable Monkey-Web 6. Start snort to listen on the VMNet1 network 7. Using your Windows client browser, go to the DSL Web page http:// 8. Record your results in a screen shot that you will submit in the assignment quiz
write a custom Snort rule to handle Inbound and Outbound HTTP traffic on the Private (Host-Only) network. Upload a screen shot of the Snort console displaying the alerts.
In this exercise, we are going to create two Snort monitoring rules that will be used to alert on HTTP
network traffic for both Inbound and Outbound traffic. Remember, Inbound rules are those rules whose
destination is to your internal network (HOME_NET), outbound rules are directed out of your internal
network (!HOME_NET). When you use “any” there is no distinction on whether a rule is Inbound or
Outbound. When using Inbound/Outbound to describe local traffic, traffic generated on the same
network (as in this lab on VMnet-1), the Inbound reference is to your client system that is running snort
the Outbound reference is to the HTTP server.
You should now understand a little bit about custom rules, so given the following rule:
alert tcp any any -> any 80 (msg:"TCP HTTP Testing Rule"; sid:1000004;)
You should be able to determine that it will alert on “any” client messages destined for “any” HTTP
server using port 80. In this exercise, you will write two rules, which will result in the following output
being displayed in the figure below:
To perform this exercise, you will do the following:
1. Create an Inbound HTTP rule for all clients to all servers
2. Create an Outbound HTTP rule for all servers to all clients
3. Use the exact alert message as listed in the figure above a. "TCP HTTP Inbound (from server) Testing Rule" b. "TCP HTTP outbound (from client) Testing Rule"
4. Apply these rules to the local.rules file
5. Startup your DSL server (configured for the VMNet1 adapter) and enable Monkey-Web
6. Start snort to listen on the VMNet1 network
7. Using your Windows client browser, go to the DSL Web page http://
8. Record your results in a screen shot that you will submit in the assignment quiz
Trending now
This is a popular solution!
Step by step
Solved in 3 steps with 2 images
