Which system am I running? NIDS or NIPS
-
I read that Snort can run as an NIDS (network intrusion detection system) or run as an NIPS (network intrusion prevention system). I am not clear about this. Can Snort run both at the same time? How do I determine which system I am running?
-
On pfSense the distinction between IDS and IPS with Snort is a little fuzzy. By default the Snort package will run in IDS mode. You can enable blocking (a kind of IPS mode) on a per-configured-interface basis. Edit the settings for a Snort interface and you will see an option to "Block Offenders". When enabled, this turns on an optional output plugin compiled into the Snort binary on pfSense. This output plugin interfaces with the pf firewall engine to insert "block" rules up near the very top of the pf rule chain (so they will block early in packet traversal). For each IP address that triggers a Snort alert, the IP address will be added to a pf table called snort2c. Putting the IP address in that table then results in further packets from that IP being blocked.
So it's not a true IPS where the packets are simply dropped and never make it through. Instead, Snort uses libcap to get copies of all the packets traversing the interface. Once it sees enough packets to generate an alert, it pokes the offending IP address into that snort2c pf table and further packets are then blocked (existing states are also killed). How many packets "leak" before the alert and block is generated depends on the specific exploit. Some things block on a single packet, other stuff may need dozens of packets to see the complete "bad guy" pattern.
The Suricata package, on the other hand, was recently updated to include a true inline IPS mode using Netmap. Suricata on pfSense can be a true inline IPS. This is a new feature, though, and some rough spots are still being worked through. I recently posted an update to the 3.1.1 version of Suricata that is available for testing for folks running either the 2.3.3 pfSense snapshot or the 2.4 one. Once the new binary looks to be stable, it will be added to the production package server.
Bill
-
Thanks. I would really like to install/run Suricata, but since their main support (as I have heard) is the U.S. government, I can't bring myself to trust it. There is too much of a chance that the government will attempt to strong arm Suricata into installing back doors.
