Experiment No.

: 3

Experiment Name: Use Snort tool for intrusion detection.

Aim: To detect network intrusion using the Snort tool by configuring Snort as
an Intrusion Detection System (IDS), preparing specific detection rules, and
validating Snort's capability to identify and alert on suspicious network
activities such as ICMP pings, SSH attempts, and web traffic access.

Theory: Snort is a highly popular and widely deployed open-source network

intrusion detection and prevention system (IDS/IPS). Developed by Martin
Roesch in 1998, and now maintained by Cisco, Snort is a cornerstone of
network security for both individuals and organizations. It is designed to
monitor network traffic in real-time, analyze packets, and perform various
actions based on a set of user-defined rules.

The Three Primary Modes of Snort

Snort is known for its versatility and can be configured to run in three main
modes, each serving a different purpose.

1. Sniffer Mode: In this basic mode, Snort acts like a packet sniffer,
similar to tools like tcpdump. It reads network packets from a network
interface and displays them on the console. This mode is useful for
network administrators and security analysts who want to examine raw
network traffic and troubleshoot network issues.

2. Packet Logger Mode: Snort can also be used as a packet logger. In

this mode, it logs all network packets to a directory on the disk. This is
a crucial feature for debugging network traffic and for post-incident
forensic analysis. The logged packets can be re-analyzed later to
understand the full scope of a security event.

3. Network Intrusion Detection System (NIDS) / Intrusion

Prevention System (IPS) Mode: This is Snort's most powerful and
widely used mode. Here, Snort uses a rule-based language to analyze
network traffic and identify malicious activities.

o Intrusion Detection (IDS): When a packet matches a rule that

indicates a potential threat, Snort generates an alert. These
alerts are logged and can be sent to administrators via various
methods like email or syslog. The IDS mode is passive; it detects
threats but does not block them.
 o Intrusion Prevention (IPS): In this more active mode, Snort
can be configured to not only detect a threat but also to
immediately block or "drop" the malicious packet. This prevents
the attack from reaching the target system, providing a crucial
layer of real-time defense.

Procedure:

1. Install Snort

● Update system packages and install Snort using the package

manager.

● Ensure Snort services and directories are set up correctly

(e.g., /etc/snort/, /var/log/snort).

2. Configure Snort

● Edit [Link] to specify network segments and enable desired

preprocessors.

● Point log and alert files to accessible directories.

● Set HOME_NET and EXTERNAL_NET variables appropriately.

3. Create Detection Rules

● Write rules to detect ICMP pings:

alert icmp any any -> $HOME_NET any (msg:"Testing ICMP

Alert";sid:1000001;)

● Write rules for SSH attempts or unauthorized web requests,

customizing the msg field for each.

Rule for SSH Brute Force Attempts

A rule to detect multiple failed SSH attempts is:

alert tcp $EXTERNAL_NET any -> $HOME_NET 22 (msg:"ALERT:

SSH Brute Force Detected - Excessive Login Attempts";
flow:to_server; detection_filter:track by_src, count 5, seconds
60; sid:1000001; rev:1;)

Observation: This rule triggers an alert when 5 or more SSH connection

attempts from a single source occur within 60 seconds.
 ● The msg field is customized: "ALERT: SSH Brute Force Detected -
Excessive Login Attempts" clearly communicates the specific event.

Rule for Unauthorized Web Requests

To detect unauthorized or suspicious HTTP GET requests, such as

targeted access to restricted URLs or use of suspicious User-Agents:

alert tcp any any -> $HOME_NET 80 (msg:"ALERT: Unauthorized

Web Request to /admin"; flow:to_server, established;
content:"GET"; http_method; content:"/admin"; http_uri;
sid:1000002; rev:1;)

Observation: This will alert when someone tries to access "/admin" on your
web server.

● The msg is: "ALERT: Unauthorized Web Request to /admin".

4. Generate Alerts

● From the attacker machine, execute ping (ping [target IP]) and
SSH attempts (ssh [target IP]).

● Observe Snort’s alerts in log files or the console; confirm that

alerts match the custom rules.

Conclusion: Thus, we performed Intrusion detection using Snort

tool.

Experiment No. : 4

Experiment Name: Implement firewall rules using iptables tool.

Theory: iptables is a powerful firewall tool used in Linux systems to filter,

control, and manage network traffic based on configurable rules. It interacts
with the Linux kernel’s Netfilter framework, enabling administrators to allow,
block, or redirect network packets for enhanced security and traffic
management.

Core Concepts

iptables operates based on tables, chains, and rules:

 ● Tables: Define packet processing. Common tables
include filter (default for simple firewalling), nat (for network address
translation), and mangle (for packet modification).

● Chains: Built-in chains are INPUT (packets destined for the host),
OUTPUT (originating from the host), and FORWARD (passing through
the host). User-defined chains can also be created.

● Rules: Each rule in a chain determines how a packet matching

specified criteria is handled, typically by actions such as ACCEPT,
DROP, or REJECT.

Required Environment

● A Kali Linux system with iptables installed.

● A secondary device or VM on the same network for testing connectivity

and firewall rules.

Procedure:

Viewing and Managing Rules

To list current firewall rules:

sudo iptables -L

This displays all active rules organized by chain (INPUT, OUTPUT, FORWARD).

Typical Usage and Commands

● Allow loopback (localhost) traffic:

sudo iptables -A INPUT -i lo -j ACCEPT

Ensures applications on the host can communicate internally.

● Allow traffic for specific services (ports):

● HTTP: sudo iptables -A INPUT -p tcp --dport 80 -j ACCEPT

● SSH: sudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT

● HTTPS: sudo iptables -A INPUT -p tcp --dport 443 -j

ACCEPT

● These rules permit inbound access to web and administrative

services by specifying protocol (-p tcp) and port (--dport).
 ● Restricting access by IP address:

sudo iptables -A INPUT -s [Link] -j ACCEPT

sudo iptables -A INPUT -s [Link] -j DROP

Accepts packets from one IP and blocks another.

● Default policy and blocking unwanted traffic:

sudo iptables -P INPUT DROP

Sets the default to deny incoming traffic unless explicitly allowed.

Saving and Persisting Rules

● Save rules to disk:

sudo service iptables save

● For systems using iptables-persistent, use:

sudo netfilter-persistent save

Restores rules on reboot for continuing security.

Conclusion: Thus, we implemented and verified firewall rules using

iptables.

Experiment No.: 5

Name of Experiment: Fault Detection Using Nagios.

Theory: Nagios is a powerful, open-source IT infrastructure monitoring

system. It's designed to monitor various components of your IT environment
—including servers, switches, applications, and services—to ensure they are
functioning correctly. In the event of a failure or a performance issue, Nagios
alerts technical staff, allowing them to address problems proactively before
they affect end-users or critical business processes.

The Core Concept: How Nagios Works

Nagios operates on a client-server architecture. The main Nagios server is
installed on a central host, and it uses various methods to check the status
of devices and services across your network.

1. Monitoring: The Nagios server periodically executes "checks" to

monitor your IT components. These checks are typically small scripts
or programs, known as plugins.

2. Plugins: Plugins are the heart of Nagios's monitoring capability. They

are simple, executable scripts (often written in Perl, Python, or shell
script) that collect data and return a status code (e.g., "OK,"
"Warning," "Critical," "Unknown").

o Agent-based Monitoring: This involves installing a Nagios

agent, such as NRPE (Nagios Remote Plugin Executor) or
NCPA (Nagios Cross-Platform Agent), on the remote server
or device. The Nagios server then queries this agent, which
executes the local plugin and sends the result back. This is
common for monitoring host-specific metrics like CPU usage,
memory, or disk space.

o Agentless Monitoring: For devices like routers, switches, and

firewalls, Nagios can use standard protocols like SNMP (Simple
Network Management Protocol) to collect data without
needing a dedicated agent installed on the device.

3. Status and Alerts: Based on the results from the plugins, Nagios
determines the state of the monitored host or service.

o OK: Everything is functioning normally.

o Warning: A problem is starting to develop (e.g., disk usage is at

80%).

o Critical: A severe problem has occurred (e.g., the service has

failed or disk usage is at 95%).

o Unknown: Nagios is unable to determine the status.

4. Notifications and Reporting: When a host or service changes from

an "OK" state to a "Warning" or "Critical" state, Nagios sends alerts to
the designated technical staff. Alerts can be sent via various methods,
including email, SMS, or custom scripts. Nagios also provides a
historical record of outages, events, and notifications, which is crucial
for service-level agreement (SLA) reporting and performance analysis.
Procedure:

[Link] Required Dependencies

sudo apt update

sudo apt install wget unzip curl openssl build-essential libgd-dev libssl-dev
apache2 php libapache2-mod-php php-gd -y

2. Create Nagios User and Group

sudo useradd nagios

sudo groupadd nagcmd

sudo usermod -a -G nagcmd nagios

sudo usermod -a -G nagcmd www-data

3. Download and Install Nagios Core

wget [Link]
[Link]

sudo tar -zxvf [Link]

cd nagios-4.4.6

sudo ./configure --with-command-group=nagcmd

sudo make all

sudo make install-groups-users

sudo make install

sudo make install-daemoninit

sudo make install-commandmode

sudo make install-config

sudo make install-webconf

4. Install Nagios Plugins

cd ~

wget [Link]
sudo tar -zxvf [Link]

cd nagios-plugins-2.3.3/

sudo ./configure --with-nagios-user=nagios --with-nagios-group=nagios

sudo make

sudo make install

5. Configure Apache for Web Interface

sudo a2enmod rewrite

sudo a2enmod cgi

sudo systemctl restart apache2

sudo htpasswd -c /usr/local/nagios/etc/[Link] nagiosadmin # Set a

password

6. Verify and Start Nagios

sudo /usr/local/nagios/bin/nagios -v /usr/local/nagios/etc/[Link]

sudo systemctl start nagios

sudo systemctl enable nagios

The Nagios web interface should now be available at:

[Link]

Login with the username nagiosadmin and the password you set.

7. Configure Monitoring Targets (Hosts/Services)

● Edit /usr/local/nagios/etc/objects/[Link] (or /usr/local/nagios/etc/

objects/[Link])

● Add a service like this for HTTP:

define service{

use generic-service

host_name localhost

service_description HTTP

check_command check_http
}

● Save and reload Nagios:

sudo systemctl reload nagios

8. Simulate a Fault

● Stop the monitored service (e.g., Apache):

sudo systemctl stop apache2

Observation: Watch the Nagios web interface for alerts. A critical alarm
should appear indicating HTTP is down.

● Restore service after test:

sudo systemctl start apache2

Conclusion: Thus, we have used Nagios for fault detection.

Experiment No. 7: Protocol Analysis with Tcpdump

Aim: To use tcpdump for analyzing different protocols such as http, https,
ftp, icmp, dns, arp, etc.

● Theory: Tcpdump is a free and open-source packet analyzer

originally developed for Unix systems in 1988. It’s now available on
Linux, macOS, and Windows (via WSL or compatible ports).

● It captures packets from a network interface and displays them in a

human-readable format.

● It supports a wide range of protocols including TCP, UDP, ICMP, ARP,

DNS, HTTP, and more.

⚙️Core Features
 ● Real-time packet capture: Monitors live traffic on specified
interfaces.

● Protocol filtering: Allows filtering by IP, port, protocol,

source/destination address.

● Offline analysis: Can read .pcap files generated by other tools like
Wireshark.

● Custom output: Offers verbose, timestamped, and hex-dump views

for deeper inspection.

● Scriptable: Easily integrated into shell scripts for automated

monitoring or forensic logging.

Procedure:

1. Install tcpdump by using command

sudo apt install tcpdump

2. Open two terminals in Kali Linux:

o Terminal 1: Run tcpdump (capture).

tcpdump -h
Checks the tcpdump installation and version
ip link show

Identifies the network interface

o Terminal 2: Generate network traffic (ping, curl, etc.).

sudo tcpdump -i eth0 -vvv

Details of data captured

Sample Output:
Sample Output Explanation:

The fields may vary depending on the type of packet being sent, but this is the general format.

The first field, 08:41:13.729687, represents the timestamp of the received packet as per the
local clock.

Next, IP represents the network layer protocol—in this case, IPv4. For IPv6 packets, the value
is IP6.

The next field, [Link].22, is the source IP address and port. This is followed by the
destination IP address and port, represented by [Link].41916.

After the source and destination, you can find the TCP Flags Flags [P.]. Typical values for this
field include:

Val Flag
Description
ue Type

Connection
S SYN
Start

Connection
F FIN
Finish

P PUSH Data push

Connection
R RST
reset

Acknowledgme
. ACK
nt

This field can also be a combination of these values, such as [S.] for a SYN-ACK packet.

Next is the sequence number of the data contained in the packet. For the first packet captured,
this is an absolute number. Subsequent packets use a relative number to make it easier to
follow. In this example, the sequence is seq 196:568, which means this packet contains bytes
196 to 568 of this flow.

This is followed by the acknumber: ack 1. In this case, it is 1 because this is the side sending
data. For the side receiving data, this field represents the next expected byte (data) on this
flow. For example, the Ack number for the next packet in this flow would be 568.
The next field is the window size win 309, which represents the number of bytes available in the
receiving buffer, followed by TCP options such as the maximum segment size (MSS) or window
scale.

Finally, we have the packet length, length 372, which represents the length (in bytes) of the
payload data. The length is the difference between the last and first bytes in the sequence
number.

ARP Analysis (Layer 2)

Capture:

sudo tcpdump -i eth0 arp

Generate traffic (Terminal 2):

ping -c 1 [Link]

ICMP Analysis (Ping)

Capture:

sudo tcpdump -i eth0 icmp

Generate:

ping -c 4 [Link]

DNS Analysis

Capture:

sudo tcpdump -i eth0 port 53 -vvv -X

Generate:

dig [Link]

HTTP Analysis

Capture:

sudo tcpdump -i eth0 -s 0 -A port 80

Generate:

curl [Link]

HTTPS Analysis

Capture:

sudo tcpdump -i eth0 port 443

Generate:

curl [Link]

SSH Analysis

Capture:

sudo tcpdump -i eth0 port 22

Generate:

ssh user@[Link]

FTP Analysis (if available)

Capture:

sudo tcpdump -i eth0 port 21 -A

Generate:

ftp [Link]
DNS Protocol analysis output

http protocol analysis output

Conclusion: Thus, we used Tcpdump to analyze different protocols such as
TCP, UDP, HTTP, HTTPS, ICMP, DNS, FTP, ARP, SSH, etc.

Experiment NO: 8

Name of Experiment: Traffic Analysis Using BandwidthD tool.

Aim: To monitor and analyze traffic using BandwidthD tool.

Theory: BandwidthD is a free, open-source network monitoring tool that's

primarily used for tracking and visualizing bandwidth usage on TCP/IP
networks. It's a lightweight application that runs on various platforms,
including Windows and Unix-like systems, and provides network
administrators with a simple, clear overview of their network traffic.

● Two Modes of Operation: BandwidthD can be used in two ways:

o Standalone Application: It can run as a simple daemon that

generates static HTML and PNG files at a fixed interval (e.g.,
every 200 seconds). This is the most straightforward setup.

o Sensor with a Database Backend: For more complex and

scalable setups, BandwidthD can be configured to act as a
sensor that transmits its data to a backend database server (like
PostgreSQL). This dynamic setup allows for multiple sensors,
filtering, and custom reports.

Procedure:

1. Install Bandwidthd

sudo apt-get update

sudo apt-get install bandwidthd -y

2. Configure Bandwidthd

● Edit the configuration file (/etc/bandwidthd/[Link]):

 ● Choose which network interface to monitor (e.g., eth0, eth1).

● Set subnets to monitor, e.g., [Link]/24 or [Link]/24.

device eth0

subnet [Link]/24

output_cdf true

graph true

3. Start Bandwidthd Daemon

sudo systemctl start bandwidthd

sudo systemctl enable bandwidthd

4. Generate and Capture Traffic

On other networked machines, browse, stream, or download files.
Let traffic flow for several minutes to hours for meaningful data.

Observations:
1. Analyze Output
By default, Bandwidthd generates HTML reports and graphs
in /var/lib/bandwidthd/ or /usr/local/bandwidthd/htdocs/.
Open the HTML report in a browser:

[Link]

View per-IP/subnet bandwidth usage, traffic graphs, and protocol

breakdowns.
5.
 Summary Table: Bandwidth Usage by IP

IP Address Host Total Total Total Top

Name Upload Download Bandwidth Protocols
(MB) (MB) (MB)

HTTP,
[Link] [Link] 200.5 325.0 525.5 HTTPS, DNS

[Link] [Link] 150.3 480.8 631.1 HTTP, FTP

[Link] [Link] 42.1 60.2 102.3 SSH, HTTP

 Protocol Breakdown by Traffic Volume

Protocol Upload (MB) Download (MB) % of Total Traffic

HTTP 298.2 680.5 45.2%

HTTPS 150.0 235.0 24.3%

FTP 52.4 103.2 8.1%

DNS 10.0 14.0 2.1%

Other 120.1 199.5 20.3%

Result/Conclusion: Thus, we used Bandwidthd tool for monitoring and

analyzing network traffic and analyzed the traffic based on protocol,
bandwidth usage by IP, and other important conclusions.