5 This document describes how to integrate Ryu with Snort.
10 There are two options can send alert to Ryu controller. The Option 1 is easier if you just want to demonstrate or test. Since Snort need very large computation power for analyzing packets you can choose Option 2 to separate them.
12 **[Option 1] Ryu and Snort are on the same machine**
15 +---------------------+
18 +----eth0-----eth1----+
20 +-------+ +----------+ +-------+
21 | HostA |---| OFSwitch |---| HostB |
22 +-------+ +----------+ +-------+
25 The above depicts Ryu and Snort architecture. Ryu receives Snort alert packet via **Unix Domain Socket** . To monitor packets between HostA and HostB, installing a flow that mirrors packets to Snort.
28 **[Option 2] Ryu and Snort are on the different machines**
36 +-------+ +----------+ +-----------+
37 | HostA |---| OFSwitch |---| LAN (*CP) |
38 +-------+ +----------+ +-----------+
40 +----------+ +----------+
42 +----------+ +----------+
45 **\*CP: Control Plane**
47 The above depicts Ryu and Snort architecture. Ryu receives Snort alert packet via **Network Socket** . To monitor packets between HostA and HostB, installing a flow that mirrors packets to Snort.
53 Snort is an open source network intrusion prevention and detectionsystem developed by Sourcefire. If you are not familiar with installing/setting up Snort, please referto snort setup guides.
55 http://www.snort.org/documents
61 The configuration example is below:
63 - Add a snort rules file into ``/etc/snort/rules`` named ``Myrules.rules`` ::
65 alert icmp any any -> any any (msg:"Pinging...";sid:1000004;)
66 alert tcp any any -> any 80 (msg:"Port 80 is accessing"; sid:1000003;)
68 - Add the custom rules in ``/etc/snort/snort.conf`` ::
70 include $RULE_PATH/Myrules.rules
72 Configure NIC as a promiscuous mode. ::
74 $ sudo ifconfig eth1 promisc
81 1. Modify the ``simple_switch_snort.py``: ::
83 socket_config = {'unixsock': True}
84 # True: Unix Domain Socket Server [Option1]
85 # False: Network Socket Server [Option2]
88 2. Run Ryu with sample application: ::
90 $ sudo ./bin/ryu-manager ryu/app/simple_switch_snort.py
92 The incoming packets will all mirror to **port 3** which should be connect to Snort network interface. You can modify the mirror port by assign a new value in the ``self.snort_port = 3`` of ``simple_switch_snort.py``
97 $ snort -i eth1 -A unsock -l /tmp -c /etc/snort/snort.conf
99 4. Send an ICMP packet from HostA (192.168.8.40) to HostB (192.168.8.50): ::
103 5. You can see the result under next section.
108 1. Modify the ``simple_switch_snort.py``: ::
110 socket_config = {'unixsock': False}
111 # True: Unix Domain Socket Server [Option1]
112 # False: Network Socket Server [Option2]
115 2. Run Ryu with sample application (On the Controller): ::
117 $ ./bin/ryu-manager ryu/app/simple_switch_snort.py
119 3. Run Snort (On the Snort machine): ::
122 $ snort -i eth1 -A unsock -l /tmp -c /etc/snort/snort.conf
124 4. Run ``pigrelay.py`` (On the Snort machine): ::
126 $ sudo python pigrelay.py
128 This program listening snort alert messages from unix domain socket and sending it to Ryu using network socket.
130 You can clone the source code from this repo. https://github.com/John-Lin/pigrelay
133 5. Send an ICMP packet from HostA (192.168.8.40) to HostB (192.168.8.50): ::
138 6. You can see the alert message below: ::
142 icmp(code=0,csum=19725,data=echo(data=array('B', [97, 98, 99, 100, 101, 102, 103, 104, 105, 106, 107, 108, 109, 110, 111, 112, 113, 114, 115, 116, 117, 118, 119, 97, 98, 99, 100, 101, 102, 103, 104, 105]),id=1,seq=78),type=8)
144 ipv4(csum=42562,dst='192.168.8.50',flags=0,header_length=5,identification=724,offset=0,option=None,proto=1,src='192.168.8.40',tos=0,total_length=60,ttl=128,version=4)
146 ethernet(dst='00:23:54:5a:05:14',ethertype=2048,src='00:23:54:6c:1d:17')
150 icmp(code=0,csum=21773,data=echo(data=array('B', [97, 98, 99, 100, 101, 102, 103, 104, 105, 106, 107, 108, 109, 110, 111, 112, 113, 114, 115, 116, 117, 118, 119, 97, 98, 99, 100, 101, 102, 103, 104, 105]),id=1,seq=78),type=0)
152 ipv4(csum=52095,dst='192.168.8.40',flags=0,header_length=5,identification=7575,offset=0,option=None,proto=1,src='192.168.8.50',tos=0,total_length=60,ttl=64,version=4)