snort alert for system

for this part, we will learn about snort. if using backtrack 5 r1, we can find snort in menu backtrack => services => snort services.

first, start snort. after start snort, open terminal, and type "pico /etc/snort/snort.conf "

now, we can edit like this :

edit var HOME_NET any, to be like this var HOME_NET "your ip".

to finish, press "ctrl+x", "y" and press "enter".

now we can run snort.

in terminal we can type "snort -i eth0 -q -c /etc/snort/snort.conf -A console" if we use wireless, we can change "eth0" with "wlan0".

our alarm ready to "ring".

the respond if there is an attacker :

-=CMIIW=-