Introduction

This chapter explains the internal workings of Snort, the components used, and why they are used. Snort is currently at version 2.0.0 and has progressed significantly through the years. It has now reached the point of being an extremely stable and high-quality intrusion detection system (IDS).

On the CD This chapter focuses on the internal workings of Snort version 2.0.0, which is available for many platforms via the Snort homepage at www.snort.org and on the CD-ROM that accompanies this book in the Chapter 3 directory). Throughout this book, we will be focusing on the UNIX version of Snort in our examples, but rest assured that the command lines work just as well with the Windows version of Snort.

This chapter provides an overview of the entire Snort process, from packet capture to detection and logging. We will be referencing functions and sections from within the Snort source code. The Snort source code is documented (in most cases), and we recommend that, if you are a coder, you look through it while reading this chapter. If you do not have any coding experience, you will probably still pick up some useful information from the source code. The following files are a good place to start:

• snort.c Main Snort code

• decode.c Packet decoder

• rules.c Rules engine

• detect.c Detection engine

• log.c Logging engine

While the source code is vast, it is definitely worth reviewing to get a flavor of the Snort development process and open-source coding at its best.