Problem solve Get help with specific problems with your technologies, process and projects.

What kinds of network packet data can be extracted from Snort IDS?

Snort IDS may be able to track information on received network packets, but network security expert MIke Chapple explains what the intrusion detection system is best used for.

Is it possible to get the following data from a Snort intrusion detection system (IDS)?
  1. Number of packets that Snort receives from one destination only
  2. Number of packets that Snort receives from all senders
  3. The time between two received packets
Is this information useful from a security perspective, or should I turn my focus toward other Snort data points?
You might be able to extract some of that information from a Snort sensor, but I'd recommend turning your focus toward other data points. For your first two requests, you should use a NetFlow aggregator. There are numerous dedicated systems designed to find these basic network statistics.

I'm not sure why you'd need to collect "the time between two received packets." Snort doesn't keep a record of every received packet unless you specifically instruct it to do so. Under Snort's primary settings, you consequently wouldn't be able to determine the time difference between two arbitrary packets. Tools like tcpdump run on the host, however, and should be able to address this third area.

Snort is an intrusion detection system, so the real question you should be asking is, "What type of unusual events does Snort detect on my network?" On any network using an IDS for the first time, you'll likely find a number of false positive reports. Your next question should then be, "Which of those alerts can I safely ignore?" Once you have the answers to those questions in hand, you can use Snort as part of your ongoing routine to monitor the network for potential security events.

More information:

  • Check out SearchSecurity.com's Snort Intrusion Detection and Prevention Guide.
  • Should Snort be configured with a FreeBSD router? Mike Chapple explains.
  • This was last published in September 2007

    Dig Deeper on Network intrusion detection and prevention (IDS-IPS)

    Have a question for an expert?

    Please add a title for your question

    Get answers from a TechTarget expert on whatever's puzzling you.

    You will be able to add details on the next page.

    Start the conversation

    Send me notifications when other members comment.

    Please create a username to comment.