Please take a moment to read http://bit.ly/demandglobalchange, to help share the message and support the initiative to tell our leaders to focus on addressing the global world problems, instead of complaining about the effects of their lack of leadership. Be a leader yourself, and share this with as many people as possible. #demandglobalchange // https://www.facebook.com/demandglobalchange



Please consider donating: https://www.corelan.be/index.php/donate/


1,196 views | This page as PDF

Running Snort with Dynamic IP on Fedora

One of my Linux boxes has a direct cable connection to the internet. I’ve been using Snort in corporate environments for a long time now, but I never had to configure snort to look at interfaces that have a DHCP assigned IP address and actually use that IP address as its HOME_NET.

There’s an easy way (which may not work with an older version of Snort), and there’s a somewhat ‘harder’ way (With a couple of scripts, this can be done as well).

The easy way consists of using a Snort variable that refers to the Ethernet interface. Use the following line in your snort.conf file and you should be fine.
var HOME_NET $eth1_ADDRESS

If that doesn’t work, you can use the scripts.

Before going into the details, I need to make some assumptions :

  1. eth1 is the internet facing interface, IP is DHCP assigned
  2. I’m going to consider the IP address of that interface as my HOME_NET snort variable
  3. I’m not going to use any other IP addresses or subnets in the HOME_NET variable (although this could be easily done by changing the scripts)
  4. I’ve created two additional folders : /root/conf and /root/bin. Both are only accessible by root

First of all, you need to build the snort.conf file. Just leave out the HOME_NET setting at the top of the script. My snort installation sits under /snortinternet. Put the (incomplete) snort.conf file (the file without the ‘var HOME_NET=’ entry somewhere else (under /root/conf for example)

Create a script called ‘geteth1.sh‘ and put it under /root/bin. This script contains the following commands :

#!/bin/bash
/sbin/ifconfig eth1 | awk ‘/inet/ { print $2 }’ | awk -F “:” ‘{ print $2 }’

(This script will output the IP address that is assigned to eth1)

Next, create another script called ‘createsnortconf.sh‘ and save it under /root/bin :

#!/bin/bash

echo ‘var HOME_NET [‘`/bin/bash /root/bin/geteth1.sh`’/32]’>/root/conf/snorttop.conf
cat /root/conf/snort.conf >>/root/conf/snorttop.conf
cp /root/conf/snorttop.conf /snortinternet/snort.conf

This script basically grabs the IP address of eth1, stores it into a temporary file, puts the temporary file and the (incomplete) snort.conf file from /root/bin together and overwrites the /snortinternet/snort.conf file with the new file.

If you keep you snort.conf file somewhere else, just edit the paths in the script and you’ll be fine.

Next, make sure to run the script prior to starting snort. I usually create a ‘runsnort.sh’ script that will fire up snort with the necessary parameters, so that would be a good place to launch the script from.

Note : if you decide to make changes to your snort.conf, make sure to change the snort.conf file under /root/conf and then run the createsnortconf.sh script again to apply the changes to the /snortinternet folder.

© 2007 – 2008, Corelan Team (corelanc0d3r). All rights reserved.

Related Posts:

Comments are closed.

Corelan Live training

Since 2011, Corelan GCV has been teaching live win32 exploit dev classes at various security cons and private companies & organizations.

You can read more about the training and schedules here

Demand Global Change

The world needs your help !

Please take a few moments to read the "Demand Global Change Call For Action" document at
http://bit.ly/demandglobalchange
Read the full document at
http://bit.ly/demandglobalchange_full and share the message with as many people as possible.

Like the Facebook page, and SHARE it with everyone you know.



Donate

Want to support the Corelan Team community ? Click here to go to our donations page.

Want to donate BTC to Corelan Team?



Your donation will help funding server hosting.

Protected by Copyscape Web Plagiarism Tool

Corelan Team Merchandise

You can support Corelan Team by donating or purchasing items from the official Corelan Team merchandising store.

Corelan on IRC

You can chat with us and our friends on #corelan (freenode IRC)

Categories