International Journal of Engineering Research & Technology (IJERT)

ISSN: 2278-0181
Vol. 1 Issue 10, December- 2012

Signature-Based Network Intrusion Detection System

Using SNORT And WINPCAP

Sagar N. Shah* Ms. Purnima Singh

M.E. (Computer Science & Engineering), Assistant Professor, Computer Science & Engineering,
Parul Institute of Engineering & Technology, Parul Institute of Engineering & Technology,
Vadodara, Gujarat, India Vadodara, Gujarat, India

Abstract- Nowadays, organizations discover detection system’s main role in a network is to help
that it is essential to protect their valuable computer systems to prepare and deal with the
information and internal resources from network attacks.
unauthorized access like deploying firewall. As
the use of internet is growing rapidly the Intrusion detection functions include [2]:
possibility of attack is also increasing in that
ratio. Signature is the pattern that you look for  Analysis of abnormal activity patterns
inside a data packet. Signatures may be present  Analyzing system configurations and
in different parts of a data packet depending vulnerabilities
upon the nature of the attack. Intrusion  Ability to recognize patterns typical of
detection system’s main role in a network is to attacks
help computer systems to prepare and deal with  Monitoring and analyzing both user and
the network attacks. Intrusion detection systems system activities
(IDS) have become a key component in ensuring  Assessing system and file integrity
RRTT
the safety of systems and networks. These
systems enforce a security policy by inspecting Intrusion Detection Systems (IDS) inspect arriving
arriving packets for known signatures packets for malicious content (signatures) as
IIJJEE

(patterns). Snort is mostly used signature based defined by a security policy. Unfortunately,
IDS because of it is Lightweight and open source comparing packet headers and payloads against a
software. Basic analysis and security engine policy can be complex and time-consuming. For
(BASE) is also used to see the alerts generated example, it has been found that content matching
by Snort. In this paper we have implemented the (scanning for signatures) accounts for more than
signature-based Network intrusion detection 70% of the packet processing time [3],[4].
using Snort and WinPcap.
This paper focuses on analyzing the abnormal
-
Keywords Network Intrusion Detection System, activity that has been detected by our Intrusion
Snort, Signature-based, WinPcap, BASE Detection System using Snort and WinPcap. Snort
is a popular NIDS that is used to audit network
packets and compare those packets with the
database of known attack signature and this attack
I. INTRODUCTION signature database must be updated time by time.

As the use of technology is increases, risk

associated with technology is also increases. II. SIGNATURE-BASED
Network security is the big challenge among the
researchers. People are working in the field of NETWORK IDS
network security from 1987 when Dorothy
Denning published an intrusion detection model A signature-based NIDS examines ongoing traffic,
[1]. But till now we did not get any perfect activity, transactions, or behaviour for matches
solution. While the availability of continuous with known patterns of events specific to known
communication has created many new attacks. As with antivirus software, a signature-
opportunities, it has also brought new possibilities based NIDS requires access to a current database of
for malicious users. The Importance of network attack signatures and some way to actively
Security is therefore growing; one of the ways of compare and match current behaviour against a
malicious activity detection on a network is by large collection of signatures.
using Intrusion Detection System. Intrusion

www.ijert.org 1
 International Journal of Engineering Research & Technology (IJERT)
ISSN: 2278-0181
Vol. 1 Issue 10, December- 2012

Signature based detection system (also called Snort is basically the combination of multiple
misuse based), this type of detection is very components. All the component work together to
effective against known attacks [5]. It implies that find a particular attack and then take the
misuse detection requires specific knowledge of corresponding action that is required for that
given intrusive behaviour. An example of Signature particular attack. Basically it consists of following
based Intrusion Detection System is SNORT. major components as shown in figure 1 [7]:

Advantages [6]: 1. Packet Decoder

2. Preprocessor
 Signature definitions are modeled on 3. Detection Engine
known intrusive activity. So, the user can 4. Logging and Alerting System
examine the signature database, and 5. Output Modules
quickly determine which intrusive activity
the misuse detection system is
programmed to alert on.
 Misuse detection system begins protecting
your network immediately upon
installation.
 There are low false positives as long as
attacks are clearly defined in advance.
 When an alarm fires, the user can relate
this directly to a specific type of activity
occurring on the network.

Disadvantages [6]:

 One of the biggest problem for Signature

RRTT
Figure 1: Component of Snort [7]
based NIDS is how to keep up with large
volume of incoming traffic when each
Packet comes from internet and enters into packet
packet needs to be compared with every
decoder and it goes through several phases,
IIJJEE

signature in the database. So, processing

required action is taken by snort at every phase like
the whole traffic is so time-consuming and
if detection engine found any miscellaneous
will slow down the throughput of the
content in packet then it drop that packet and in the
system.
way towards output module packet is logged in or
 Misuse detection system must have a alert is generated.
signature defined for all of the possible
attacks that an attacker may launch against 1. Packet Decoder:
your network. This leads to the necessity The packet decoder collects packet from different
for frequent signature updates to keep the network interfaces and then send to be preprocessor
signature database of your misuse or sent to the detection engine. Network interface
detection system up-to-date. might be Ethernet, SLIP, PPP and so on.
 Misuse detection has a well-known
problem of raising alerts regardless of the 2. Preprocessor:
outcome. For example a window worm It works with snort to modify or arrange the packet
trying to attack a Linux system, the misuse before detection engine to apply some operation on
IDS will send so many alerts for packet if packet is corrupted. Sometimes they also
unsuccessful attacks which may be hard to generate alert if any anomalies found in the packet.
manage. Basically it matches the pattern of whole string. so,
 Someone may set up the misuse detection by changing the sequence or by adding some extra
system in their lab and intentionally try to value intruder can fool the IDS but preprocessor re-
find ways to launch attacks that bypass arranges the string and IDS can detect the string.
detection by the misuse detection system. Preprocessor does one very important task i.e.
 The knowledge about attacks is very defragmentation. Because sometimes intruder
dependent on the operating system, break the signature into two parts and send them in
version and application hence tied to two packets. So, before checking the signature both
specific environments. packet should be defragmented and only then
III. Component of Snort signature can be found and this is done by
preprocessor.

www.ijert.org 2
 International Journal of Engineering Research & Technology (IJERT)
ISSN: 2278-0181
Vol. 1 Issue 10, December- 2012

3. Detection Engine: part usually contains an alert message and

Its main work is to find out intrusion activity exits information about which part of the packet should
in packet with the help of snort rules and if found be used to generate the alert message. The options
then apply appropriate rule otherwise it drops the part contains additional criteria for matching a rule
packet. It takes different time to respond different against data packets. A rule may detect one type or
packet and also depends upon the power of multiple types of intrusion activity. Intelligent rules
machine and number of rules defines in the system. should be able to apply to multiple intrusion
signatures.
4. Logging and Alerting System:
This system is responsible from the generation of
alerts and logging of packets and messages.
Depending upon what the detection engine finds Figure 3: Structure of IDS rule header
inside a packet, the packet may be used to log the
activity or generate an alert. All of the log files are
The action part of the rule determines the type of
stored under a preconfigured location by default.
action taken when criteria are met and rule is
This location can be configured using command
exactly matched against a data packet. Typical
line options. There are many command line options
actions are generating an alert or log message or
to modify the type and detail of information that is
invoking another rule.
logged by the logging and alerting system. All log
files are kept by default under C:\Snort\log folder
i. Pass – This action tells Snort to ignore the
and by using –l command line option, location can
packet. This action plays an important
be changed.
role in speeding up Snort operation in
cases where you don’t want to apply
5. Output Modules:
checks on certain packets. For example, if
Output modules or plug-ins save output generated
you have a vulnerability assessment host
by the logging and alerting system of Snort
on your own network that you use to find
depending on how user wants for different
possible security holes in your network,
operation. Mainly it controls the different output
RRTT
you may want Snort to ignore any attacks
due to logging and alerting system. Depending on
from that host. The pass rule plays an
the configuration, output modules can send output
important part in such a case.
messages a number of other destinations.
ii. Log – The log action is used to log a
IIJJEE

Commonly used output modules are:

packet. Packets can be logged in different
 The database module is used to store Snort
ways, as discussed later in this book. For
output data in databases, such as MySQL,
example, a message can be logged to log
MSSQL or Oracle,
files or in database. Packets can be logged
 The SNMP module can be used to send with different levels of detail depending
Snort alerts in the form of traps to a on the command line arguments and
management server, configuration file.
 The Sending Server Message Block iii. Alert – The alert action is used to send an
(SMB) alerts module can send alerts to alert message when rule conditions are
Microsoft Windows machines in the form true for a particular packet. An alert can
of pop-up SMB alert windows, be sent in multiple ways. For example,
 The syslog module logs messages to the you can send an alert to a file or to a
syslog utility (using this module you can console. The functional difference
log messages to a centralized logging between Log and Alert actions is that
server.) Alert actions send an alert message and
then log the packet. The Log action only
IV. Rule structure of snort logs the packet.

All IDS rules have two logical parts: rule header The protocol part is used to apply the rule on
and rule option [8]. This is shown in Figure 2. packets for a particular protocol only. This is the
first criterion mentioned in the rule. Some
examples of protocols used are IP, ICMP, UDP and
etc.
Figure 2: Basic Structure of IDS Rules
The address part define source and destination
The rule header contains information about what address. Address may be a single host, multiple
action a rule takes. It also contains criteria for host or network address. The researcher can also
matching a rule against data packets. The options use these parts to exclude some address from a

www.ijert.org 3
 International Journal of Engineering Research & Technology (IJERT)
ISSN: 2278-0181
Vol. 1 Issue 10, December- 2012

complete network. Source and destination address the originator of the connection
are determined based on direction field. As an
example, if the direction field is “->”, the address
on the left side is source and the address at the Msg “…” : this message is printed to the
right side is destination. snort.alert log file.

In case of TCP or UDP protocol, the port parts Flags : SYN and ACK flags are set.
determine the source and destination ports of a Other flags such as PSH, FIN,
packet on which the rule is applied. In case of RST, and URG could also be
network layer protocols like IP and ICMP, port specified as part of a signature.
numbers have no significance.
V. Snort NIDS Topology
The direction part of the rule actually determines
which address and port number is used as source From the figures referred from [7] given below
and which as destination. Snort utilizes a pattern concept of signature based IDS can easily
matching model for detection of network attack understand. It is clear that when any person sends
signatures using identifiers such as TCP fields, IP data inside the network so first of all it goes to
addresses, TCP/UDP port numbers, ICMP Default gateway and check rule and if found
type/code, and strings contained in the packet malicious then it discards the packet otherwise send
payload. For example, Snort may have a rule such to destination system.
as the following:

Alert tcp $HOME_NET 12345 ->

$EXTERNAL_NET any (msg:”IDS80-
BACKDOOR ACTIVITY- Possible
Netbus/GabanBus”; flags: SA)

This is the pattern-matching rule for the Netbus

RRTT
Trojan. Let us break this rule down to understand
how the Snort packet engine recognizes signatures.
IIJJEE

Alert : this is an alert message

Tcp : snort will be focused on the IP

protocol

$HOME_NET : HOME_NET is a variable set to Figure 4: Snort NIDS Topology [7]

an organization’s IP address
range (for example 10.0.0.0/16)

12345 : destination TCP port number of

original SYN packet from
$EXTERNAL_NET. This
represents the SYN/ACK
portion of the TCP handshake.
Figure 5: Snort Signature Database [7]
-> : Indicate that traffic will be
matched for source IP of In figure 4 Snort IDS computer is connected
HOME_NET and destination IP through the internet. Networks send packets to
of EXTERNAL_NET. snort IDS devices. Before reaching the packet to
destination, default gateway checks that packet and
$EXTERNAL_NET :EXTERNAL_NET is a if packet is malicious then snort IDS device
variable set to an IP address discards the packet otherwise send packet to
range to be matched. For devices and if in figure 5 working of IDS device is
instance, this might be set to clearly mention that how device checks the packets.
0.0.0.0 if the IDS is placed So, when a packet comes to device then it use
at an Internet connection. comparing tool to check that packet from the
database of signature stored in IDS device and if it
Any : the “any” keyword refers to get result that packet is matched from the database
TCP source port number for

www.ijert.org 4
 International Journal of Engineering Research & Technology (IJERT)
ISSN: 2278-0181
Vol. 1 Issue 10, December- 2012

then IDS system discard the packet otherwise it BASE is a web interface to perform analysis of
sends the packet to destination system. intrusions that snort has detected on the network.
This application provides a web front-end to query
VI. TOOLS USED IN SIGNATURE- and analyze the alerts coming from a SNORT IDS
BASED NIDS SYSTEM system. It uses a user authentication and role-base
system; so that you as the security admin can
decide what and how much information each user
To implement signature-based network Intrusion can see. It also has a simple to use, web-based
detection System; we need to install some tools, setup program for people not comfortable with
such as Snort, BASE and WinPcap. editing files directly [12].
Snort [9]

Snort is an open source network intrusion detection VII. IMPLEMENTATION DETAILS

and prevention system [9] (available at http://
www.snort.org/snort-downloads?). It can analyze WinPcap provide the packet-capture and filtering
real-time traffic analysis and data flow in network. engines of many open source and commercial
It is able to check protocol analysis and can detect network tools, including protocol analyzers (packet
different type of attack. In NIDS snort basically sniffers), network monitors, network intrusion
checks packet against rule written by user. Snort detection systems, traffic-generators and network-
rules can be written in any language, its structure is testers. It also support saving captured packets to a
also good and it can be easily read and rules can be file [13], and reading files containing saved
modify also. In buffer overflow attack, snort can packets; applications can be written, using
detect the attack by matching the previous pattern WinPcap, to be able to capture network traffic and
of attacks and then will take appropriate action to analyze it, or to read a saved capture and analyze it,
prevent from attack. In signature based IDS system using the same analysis code. A capture file saved
if pattern matches then attack can be easily found in the format that WinPcap use can be read by
but when a new attack comes then system fails but applications that understand that format, such as
RRTT
snort overcome this limitation by analyzing the tcpdump, Wireshark, CA NetMaster.
real-time traffic. Whenever any packet comes into
network then snort checks the behaviour of Snapshot
network if performance degrades of network then
IIJJEE

snort stop the processing of packet, discards the

packet and stores its detail in the signature database
[10].

WinPcap

WinPcap is an open source library for packet

capture and network analysis [11] for the Win32
platforms.

The purpose of WinPcap is to give this kind of

access to Win32 applications; it provides facilities
to:

 capture raw packets, both the ones

destined to the machine where it's running
and the ones exchanged by other hosts (on Figure 6: Packet Details
shared media)
 Filter the packets according to user- As soon as we start the internet, the host systems
specified rules before dispatching them to on which we access this module start capturing the
the application. packets. It shows the data in the decimal format.
 Transmit raw packets to the network. The details of the captured packets are shown in the
 Gather statistical information on the snapshot. The Default Gateway used to capture and
network traffic. monitor the packet is as follows: Getting IP
address to Keep watch / monitor.
m_Monitor = new Socket
Basic Analysis and Security Engine (BASE) [12]
(AddressFamily.InterNetwork, SocketType.Raw,
ProtocolType.IP);

www.ijert.org 5
 International Journal of Engineering Research & Technology (IJERT)
ISSN: 2278-0181
Vol. 1 Issue 10, December- 2012

REFERENCES
[1] D. E. Denning. “An Intrusion-Detection
Model”. IEEE transactions on software
engineering, Volume : 13 Issue: 2,
February 1987.

[2] Harley Kozushko, “Intrusion Detection:

Host-Based and Network-Based Intrusion
Detection Systems”, on September 11,
2003.

[3] S. Antonatos K.G. Anagnostakis and E. P.

Markats. Generating realistic workloads
for network intrusion detection systems. In
Figure 7: Packet Information and Hex Data Proceedings ACM Workshop on Software
and Performance., 2004.
Once we select any packet by double click on it
that is shown in the first snapshot, we are able to [4] Mike Fisk and George Varghese. Fast
see the details of the packet i.e. the header field and content-based packet handling for
the payload. The header part is consist of source IP intrusion detection. Technical report,
address and destination IP address, name of the University of California at San Diego,
protocol, Time to live field, version of a protocol, 2001.
Header length, various type of services and the
total length field. The data of the header field is [5] D. E. Denning, "An intrusion-detection
shown in the decimal form whereas the data of the model." IEEE Transactions on Software
payload is display in the hexadecimal form. Engineering, Vol.SE-13(No.2):222-232,
Feb. 1987.
RRTT

VIII. CONCLUSION AND FUTURE WORK [6] Guan Xin and Li Yun-jie, “A new
Intrusion Prevention Attack System Model
IIJJEE

based on Immune Principle”, International

Security is a big issue for all networks in today's Conference on e-Business and Information
enterprise environment. Hackers and intruders have System Security (EBISS), in IEEE, pp. 1-
made many successful attempts to bring down 4, 2010.
high-profile company networks and web services.
Snort is free and powerful software that capable of [7] Vinod Kumar, Vinay Pathak, Dr. Om
performing real-time traffic analysis and packet Prakash Sangwan, “Evaluation of Buffer
logging. It considered as the heart of Intrusion Overflow and NIDPS”, International
Detection System. Once the Snort will identify any Journal on Computer Science and
intrusion then it will send alert to security person Emerging Trends (IJCSET), August issue,
and security person will take required action 2012.
immediately.
[8] Rafeeq A. (2003). Intrusion Detection
However, snort is a strong Intrusion Detection Systems with Snort advance IDS technique
System; the problem is that snort system is not Using Snort, Apache, MySQL, PHP, and
familiar with Windows Operating System. In this ACID. Publication Pearson Education.
paper, Signature-based Network Intrusion Upper Saddle River, New Jersey.
Detection System with snort has been implemented
and configured with windows-based environment. [9] Caswell, Brian. “Snort - The Open Source
The results show that it is possible to configure Network IDS: More info about Snort”
snort IDS with Windows and it can be configured URL: http://www.snort.org
as a firewall.
[10] Intrusion Detection with SNORT:
The future work is to develop a parallel technique Advanced IDS Techniques Using SNORT,
(parallelization) for improving the performance of Apache, MySQL, PHP, and ACID by
signature-based network intrusion detection system Rafeeq Ur Rehman.
and reduce the processing time of the traffic.

www.ijert.org 6
 International Journal of Engineering Research & Technology (IJERT)
ISSN: 2278-0181
Vol. 1 Issue 10, December- 2012

[11] The industry-standard windows packet

capturelibrary,"Winpcap,"2010.[Online].
Available: www.winpcap.org

[12] Basic Analysis and Security Engine

(BASE) project (2012). Available:
http://base.secureideas.net/about.php.

[13] Jiekun Zhang, Dafang Zhang and Kun

Huang, ― A Regular Expression
Matching Algorithm using Transition
Merging‖ IEEE, 2009.

AUTHOR’S PROFILE

Passport Author’s Name (Font Size – 10, Times New

Size Latest Roman, Bold)
Color personal profile which contains their education
Photo details, their publications, research work,
membership, achievements, with photo that will
be maximum 200-400 words. (Font Size – 8,
Times New Roman)

Passport Author’s Name ((Font Size – 10, Times

Size Latest New Roman, Bold)
Color personal profile which contains their education
Photo details, their publications, research work,
RRTT
membership, achievements, with photo that will
be maximum 200-400 words. (Font Size – 8,
Times New Roman)
IIJJEE

www.ijert.org 7