Project 2: Snort Sentinel — Practical IDS Lab

 

Detecting Network Intrusions with Snort in My Home Lab

In this project I set up Snort, an open-source Network Intrusion Detection System (NIDS), inside a virtual lab. The lab consists of an Ubuntu VM running Snort (the IDS), a Kali Linux VM used for attacking and scanning, and a Metasploitable 2 VM as a vulnerable target. The goal was to detect suspicious activity such as ICMP pings and Nmap scans, and to collect screenshots and logs for portfolio evidence.

Lab Topology & Overview

• Ubuntu (Snort IDS) — runs Snort and stores alerts/logs.
• Kali Linux — attacker machine (runs nmap, ping, etc.).
• Metasploitable 2 — vulnerable target for testing.

All VMs are placed on an isolated host-only/internal network (example subnet: 192.168.113.0/24). This keeps the testing environment contained and safe from the internet.

Tools Used

- Ubuntu (Snort)
- Kali Linux
- Metasploitable 2
- Wireshark
- Optional: ELK stack or SecurityOnion for later analysis

Setup & Key Configuration

1. Network configuration:
   - I ensured all VMs can ping one another and are on the same isolated subnet.

2. Snort installation (Ubuntu):
   - Installed Snort . During installation, I set HOME_NET to my lab subnet,

3. Snort rules:
   - Custom rules saved to /etc/snort/rules/local.rules.
   - Example rules used in this lab are included below.

Snort Rules Used

ICMP Ping detection:

alert icmp any any -> $HOME_NET any (msg:"ICMP Ping Detected"; sid:100001; rev:1;)

Nmap SYN scan detection :

alert tcp any any -> $HOME_NET any (msg:"NMAP SYN scan detected"; flags:S; sid:1000001; rev:1;)

Running Snort and Testing

Start Snort in console alert mode on the interface that holds the lab IP :
sudo snort -A console -q -c /etc/snort/snort.conf -i ens33

From Kali, test detection:
• ICMP ping: `ping -c 3 <target-ip>`
• Nmap SYN scan: `sudo nmap -sS <target-ip>`

Observe alerts printed to the Snort console, or check the Snort alert file  /var/log/snort/alert.

check pcap file on wireshark.

Screenshots / Evidence (Placeholders)

local.rules content showing ICMP and NMAP rules

Snort console showing NMAP SYN scan detected alerts

Snort console showing ICMP Ping Detected alert

nmap output on Kali showing the scan command used

Wireshark capture of the scanned packets

Results & Observations

Snort reliably detects simple network probes (ICMP pings, SYN scans) when rules are correctly written and HOME_NET is set.  

Rule syntax is strict - small typos (missing spaces, wrong separators) will break parsing; always test with `sudo snort -c /etc/snort/snort.conf -T`.  

Immediate alerts are noisy- removing thresholds shows activity instantly (useful for demos), but thresholds/detection_filter are necessary for realistic deployments to reduce false positives.  

Isolated lab networks are essential - keep Metasploitable and scanning traffic on a host-only/internal network to avoid accidental exposure.  

 Future work: add thresholding, expand rule coverage, integrate alerts into ELK/SIEM, and tune rules to reduce false positives.

This project demonstrates my ability to configure and use IDS tools like Snort to detect and analyze attacks. It also highlights my understanding of network security fundamentals and packet analysis.