Lab 2 – CSEC630

1. When running Snort IDS why might there be no alerts?

When using Snort IDS, there are several modes that if configured properly, will generate alerts. Alerts are set by the user within the command prompt when initiating a rule set. There are five alerting options available with Snort IDS. According to (Roesch, 1999), Alerts may either be sent to syslog, logged to an alert text file in two different formats, or sent as Win-Popup messages using the Samba smbclient program. If there has been no alerts, the selected rule set was set may not have been enabled by the user. Another scenario where alerts may not occur is when another task is being performed. According to (Roesch, 1999) when alerting is unnecessary or inappropriate, such as when network penetrations tests are being performed.

2. If we only went to a few web sites, why are there so many alerts?
Snort IDS performs numerous functions that would generate an alert. Alerts are generated based on any suspicious network activity. Although a user may have only visited 5 sites, snort may have generated 12 or more alerts that were generated due to anomalies detected from the 5 sites visited. 3. What are the advantages of logging more information to the alerts file?
The advantage of logging additional information within the alerts file is that it can provide additional information as to the origination or source of what caused the alert. If the administrator is better informed on the sources of any anomalies or suspicious activity, he/she can make adjustments to prevent the known source from continuing to make unwarranted attempts to access the network.

4. What are the disadvantages of logging more information to the alerts file?
One of the disadvantages of logging more information is that if that information was compromised by an outside threat, the information could