Category: Network security

Snort has three modes: Sniffer, Packet Logger, and Network Intrusion Detection System. Sniffer mode captures and displays network traffic in real-time.

Snort is an NIDS that detects network attacks by analyzing traffic. Configure rules in `local.rules` (e.g., `alert tcp any any -> any 80…

Set up a test environment on one machine with detailed VMware installation guides for installing both VMware and Windows 7.

Sun Haitao articles are continuously updated. Stay tuned for the latest content!

Snort+Base – A Common Solution for Building Intrusion Detection Systems by SW_Sun Wei discusses the IDS solution Snort+Base. The article is continuously updated.

Intrusion Detection Systems (IDS) identify suspicious activities via network and host systems analysis. Before installing an IDS, a comprehensive IDS Policy to detect…

Snort is an open-source NIDS, compatible with Windows and Linux. The author prefers Snort on Linux for research. Setup on Ubuntu involves installing…

If the configuration file is correct, it displays an image tag. Snort includes detection templates for various protocols in the /etc/snort/rules directory.

This Snort setup guide documents installing Snort and encountering some issues. It covers adding EPEL, downloading source packages, registering for rule sets, and…

The Decoder Module in Snort captures, decodes network packets by protocol layers, and passes them to the preprocessor for further analysis before rule…