Now that we demonstrated app IDs used for Globomantics,
they want us to explore other modules that can help stop network reconnaissance.
You mentioned the Port Scan module,
and they gave you the green light to configure and test Port Scan.
They want you to satisfy the specific goal of detecting
attempted Nmap port scans and generating alerts so they are
aware when someone is conducting these scans.
Let's head over to our Snort server and get started.
Once again,
our first step is going to be to go back into the Snort configuration
file and make sure that Port Scan is activated.
We can see from this configuration that Port Scan is
already enabled and set to a medium level.
Although it is tempting to change this to high,
we should probably test if this level is sufficient before modifying it further.
I'll go ahead and exit out and switch over to the Kali Linux machine.
Before we switch over to that machine,
we need to make sure we turn Snort back on by running this command.
And once it's up and running,
we can head over to our Kali Linux machine and run that scan.
I am going to run a particularly noisy Nmap scan to test
this configuration by scanning the entire internal subnet
and activating script scanning, OS detection,
version detection, and speeding up the scan.
While that runs, let's check our Snort server for some alerts.
Sure enough, that flooded our screen with alerts.
But not all of these are port scan alerts.
We can see a few here and there that list Nmap scan
specifically or that have the port scan identifier,
letting us know that Port Scan is working as intended.
Although this satisfies our requirement,
let's see what happens if we set the option to low and slow down our scan.
Let's go back to our Snort configuration file.
Go ahead and change this medium to low, and then save that file, and exit out.
Before I restart this port scan,
I'm going to make one other change to our local.rules file.
I'm going to go ahead and turn off these alerts for ICMP and HTTP,
and that should reduce some of our alerts that Nmap produces.
This will allow us to focus on the port scan alerts exclusively.
So we'll go ahead and run that same Snort command,
and now that it started up,
we'll head over to our Kali Linux machine and run a different Nmap scan.
This time we'll just target the single Metasploitable host,
turn off script scanning, and disable the ping scan,
but leave OS detection and version detection.
We'll also change this timing template to a much
slower scan and see what happens.
While that runs, let's head over to our Snort server and check for alerts.
Even on the low setting with a slow scan,
our Snort server is still detecting the port scan.
We're not getting nearly as many alerts as we were getting previously,
but that's probably due to the speed and breadth of the scan that we're running.
We can periodically see the TCP portscan alert,
letting us know that this is occurring between Metasploitable and Kali Linux.
For a quick recap on what we covered in this demo,
we tested the Port Scan module on both the low and medium settings.
We verified that it could detect both a noisy scan
and a scan with a specific target, run slowly and with fewer options,
satisfying our goal for Globomantics in this scenario.