Intrusion Detection & Prevention Systems: Architecture & Snort Rules

While firewalls function like security doors that determine which ports are open, an Intrusion Detection System (IDS) and Intrusion Prevention System (IPS) act as security cameras and armed guards inspecting the actual behavior of traffic passing through those doors. They examine packet payloads for known exploit signatures, suspicious behavioral anomalies, and unauthorized protocol anomalies.

IDS vs. IPS: The Critical Operational Difference

Feature	Intrusion Detection System (IDS)	Intrusion Prevention System (IPS)
Placement	Out-of-Band (Passive) via SPAN/Mirror port or Network TAP.	In-Line (Active) directly in the traffic flow between router and switch.
Action on Match	Generates an alert, logs the event, notifies SIEM. Does not stop traffic!	Drops packet immediately, resets TCP connection, blocks attacking IP.
Latency Impact	Zero network latency (monitors a mirrored copy of packets).	Introduces minor latency because packets must be inspected before forwarding.
Risk of False Positives	Low business disruption (analyst investigates false alarm later).	High risk (a false positive blocks legitimate customer transactions!).

Detection Methodologies: Signature vs. Anomaly

Signature-Based Detection: Compares packet bytes against a database of known exploit fingerprints (like antivirus signatures). Fast and highly accurate for known CVEs, but completely blind to brand new zero-day attacks.
Anomaly-Based (Heuristic) Detection: Establishes a baseline of normal network activity (average bandwidth, protocol ratios, active hours). Alerts when traffic deviates from baseline (e.g. 10,000 DNS queries per second at 3 AM). Capable of catching zero-days, but prone to higher false positive rates.

Dissecting Snort Rule Syntax

Snort is the world's most widely adopted open-source network IDS/IPS rule engine. Every Snort rule is divided into a Rule Header and Rule Options:

Anatomy of a Production Snort Rule

# Alert on any external IP attempting an /etc/passwd path traversal over HTTP
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (
    msg:"ATTACK-RESPONSES /etc/passwd path traversal detected";
    flow:to_server,established;
    content:"/etc/passwd"; nocase;
    sid:1000001;
    rev:1;
    classtype:web-application-attack;
)

alert: Action to take (options: alert, log, drop, reject).
tcp: Protocol to evaluate (tcp, udp, icmp, ip).
$EXTERNAL_NET any -> $HTTP_SERVERS 80: Source IP/port and Destination IP/port.
content:"/etc/passwd": Exact byte sequence to search for in the TCP payload.
sid:1000001: Snort ID (local custom rules use IDs > 1,000,000).

Running Snort in Packet Sniffer and NIDS Mode

# Run Snort as live packet sniffer dumping headers to console
sudo snort -v -i eth0

# Run Snort as Network IDS applying configuration rules
sudo snort -A console -q -c /etc/snort/snort.conf -i eth0

Frequently Asked Questions (FAQ) - Student & Interview Review

Q1. What is Suricata and how does it compare to Snort?

Suricata is a high-performance open-source IDS/IPS engine designed with native multi-threading architecture, allowing it to inspect 40Gbps+ multi-gigabit speeds across modern multi-core servers. It uses the exact same rule syntax as Snort.

Q2. What is a Network TAP (Test Access Point)?

A Network TAP is a dedicated hardware device inserted directly into a physical network cable that splits the optical or copper signal, sending an exact passive copy of all network traffic to an IDS sensor without introducing any delay or point of failure.