Snort® is an open source network intrusion prevention and detection system (IDS/IPS) developed by Sourcefire. Combining the benefits of signature, protocol and anomaly-based inspection, Snort is the most widely deployed IDS/IPS technology worldwide.

Installation of Snort on Windows is pretty simple.

First, you need to download and install few things. For Snort to be able to act as sniffer and IDS it needs Windows Packet Capture Library which is WinPcap. The stable latest version on the site is 4.1.1 and you can download it here.

Now when we have WinPcap installed the next step will be to download Snort. The latest version for Windows is 2.8.5.1 and you can download it here. Installation shouldn’t be a problem, if you need IPv6 support and logging to Microsoft SQL or Oracle database then you need to select proper radio and check boxes and if don’t then just go next and next to the end and that’s it. Default installation directory is C:\Snort so remember it because it will be our working dir all the time.

So we have installed WinPcap and Snort but we are not finished with installation yet. We have one more thing to download and install. The Snort rules. These rules are those small files that tells Snort what it should search for in captured packages and how to identify them, as a threat, information disclosure or something else. For us to be able to download Snort rules we have to be registered on Snort site. Registration is free and rules are one month old for free users, for those who need the latest threats detected at the same moment when they are published to the community I suggest to buy VRT subscription so you will have the latest rules directly as they are announced. So now we will download snortrules-snapshot-2.8.tar.gz rules archive file.  When you open archive file you will get following structure:

Snort rules

Copy all four directories over those in C:\Snort replacing contents that already exists on the hard drive.

Now when we are done with easy part we need to configure Snort to run. Because these rules are written for unixoid systems we need to change some things in the main config file C:\Snort\etc\snort.conf so that Snort can start at all.

Here are the things that you need to edit to be able to run snort:

Find lines 269 and 270. These lines will not allow Snort to start, at least not on Windows because Snort detects the second one as double config detection line so we need to change this.

Change from this:

config detection: search-method ac-bnfa
config detection: max_queue_events 5

To this:

config detection: search-method ac-bnfa max_queue_events 5

Now, the next thing that we need to change is lines where we say to Snort where to find dynamic preprocessor files. On lines from 298 to 303 change this:

dynamicpreprocessor file /usr/local/lib/snort_dynamicpreprocessor/libsf_dce2_preproc.so
dynamicpreprocessor file /usr/local/lib/snort_dynamicpreprocessor/libsf_dns_preproc.so
dynamicpreprocessor file /usr/local/lib/snort_dynamicpreprocessor/libsf_ftptelnet_preproc.so
dynamicpreprocessor file /usr/local/lib/snort_dynamicpreprocessor/libsf_smtp_preproc.so
dynamicpreprocessor file /usr/local/lib/snort_dynamicpreprocessor/libsf_ssh_preproc.so
dynamicpreprocessor file /usr/local/lib/snort_dynamicpreprocessor/libsf_ssl_preproc.so

To this:

dynamicpreprocessor file C:\Snort\lib\snort_dynamicpreprocessor\sf_dce2.dll
dynamicpreprocessor file C:\Snort\lib\snort_dynamicpreprocessor\sf_dcerpc.dll
dynamicpreprocessor file C:\Snort\lib\snort_dynamicpreprocessor\sf_dns.dll
dynamicpreprocessor file C:\Snort\lib\snort_dynamicpreprocessor\sf_ftptelnet.dll
dynamicpreprocessor file C:\Snort\lib\snort_dynamicpreprocessor\sf_smtp.dll
dynamicpreprocessor file C:\Snort\lib\snort_dynamicpreprocessor\sf_ssh.dll
dynamicpreprocessor file C:\Snort\lib\snort_dynamicpreprocessor\sf_ssl.dll

Next thing to change is line 324 on which we have dynamic engine path, so change it from this:

dynamicengine /usr/local/lib/snort_dynamicengine/libsf_engine.so

To this:

dynamicengine C:\Snort\lib\snort_dynamicengine\sf_engine.dll

I don’t know why, maybe some mistake, but lines bellow should be commented out by default, but they were not so we have to comment them out. Because we are not VRT subscriber and don’t have any dynamic detection files we need to coment lines from 339 to 354, so change this:

dynamicdetection file /usr/local/lib/snort_dynamicrules/bad-traffic.so
dynamicdetection file /usr/local/lib/snort_dynamicrules/chat.so
dynamicdetection file /usr/local/lib/snort_dynamicrules/dos.so
dynamicdetection file /usr/local/lib/snort_dynamicrules/exploit.so
dynamicdetection file /usr/local/lib/snort_dynamicrules/imap.so
dynamicdetection file /usr/local/lib/snort_dynamicrules/misc.so
dynamicdetection file /usr/local/lib/snort_dynamicrules/multimedia.so
dynamicdetection file /usr/local/lib/snort_dynamicrules/netbios.so
dynamicdetection file /usr/local/lib/snort_dynamicrules/nntp.so
dynamicdetection file /usr/local/lib/snort_dynamicrules/p2p.so
dynamicdetection file /usr/local/lib/snort_dynamicrules/smtp.so
dynamicdetection file /usr/local/lib/snort_dynamicrules/sql.so
dynamicdetection file /usr/local/lib/snort_dynamicrules/web-client.so
dynamicdetection file /usr/local/lib/snort_dynamicrules/web-misc.so

To this:

#dynamicdetection file /usr/local/lib/snort_dynamicrules/bad-traffic.so
#dynamicdetection file /usr/local/lib/snort_dynamicrules/chat.so
#dynamicdetection file /usr/local/lib/snort_dynamicrules/dos.so
#dynamicdetection file /usr/local/lib/snort_dynamicrules/exploit.so
#dynamicdetection file /usr/local/lib/snort_dynamicrules/imap.so
#dynamicdetection file /usr/local/lib/snort_dynamicrules/misc.so
#dynamicdetection file /usr/local/lib/snort_dynamicrules/multimedia.so
#dynamicdetection file /usr/local/lib/snort_dynamicrules/netbios.so
#dynamicdetection file /usr/local/lib/snort_dynamicrules/nntp.so
#dynamicdetection file /usr/local/lib/snort_dynamicrules/p2p.so
#dynamicdetection file /usr/local/lib/snort_dynamicrules/smtp.so
#dynamicdetection file /usr/local/lib/snort_dynamicrules/sql.so
#dynamicdetection file /usr/local/lib/snort_dynamicrules/web-client.so
#dynamicdetection file /usr/local/lib/snort_dynamicrules/web-misc.so

Now we need to trim a bit SSH preprocessor to work on Windows as it is different from Linux one, so find line 753 and change this:

preprocessor ssh: server_ports { 22 } \
max_client_bytes 19600 \
max_encrypted_packets 20 \
disable_srvoverflow \
disable_protomismatch \
disable_badmsgdir

To this:

preprocessor ssh: server_ports { 22 } \
max_client_bytes 19600 \
max_encrypted_packets 20

Now we are good to go. We can test snort easily from the command line. So now go on Start->Run and type cmd following by enter key. Now in command prompt type following commands:

c: and then enter key

cd c:\snort\bin and then enter key

snort -v -c C:\snort\etc\snort.conf -l C:\snort\log -K ascii and then enter key

So now we have entered Snort directory and started Snort on command line. You will first see Snort starting and parsing config file snort.conf and then you will see lot of output when Snort start sniffing and controlling packages on the network. If it finds any package that is not regular network traffic it will save info about it in c:\Snort\Log\alert.ids file. Simple output of one captured packet looks like this:

[**] [1:254:7] DNS SPOOF query response with TTL of 1 min. and no authority [**]
[Classification: Potentially Bad Traffic] [Priority: 2]
12/22-12:19:12.577553 192.168.137.206:53 -> 192.168.137.10:55153
UDP TTL:128 TOS:0×0 ID:5399 IpLen:20 DgmLen:79
Len: 51

Now to explain what we have here. The first line says what type of attack is it, the second line says what classification is it and what priority does it have, and the last three lines are data about the attack, attacker IP, your IP, destination and source ports and so on.

snort /service /install -c C:\Snort\etc\snort.conf -l C:\Snort\log -K ascii

Program is easy to use, offers many things for both amateur and professional use, can save and import many formats and most important it’s free.

Here are some of the features listed on home page of the NCH Software who are creator of the WavePad:

Features

• Sound editing functions include cut, copy, paste, delete, insert, silence, autotrim and more.
• Audio effects include, amplify, normalize, equaliser, envelope, reverb, echo, reverse, sample rate conversion and more.
• Full featured Mp3 editing software
• Supports a number of other file formats including wav (multiple codecs) vox, gsm, real audio, au, aif, flac, ogg and many more.
• Batch processing supports up to 32000 files allowing you to apply effects and/or convert your files as a single function.
• Tools include spectral analysis (FFT) and speech synthesis (text-to-speech).
• Recorder supports autotrim and voice activated recording and more.
• Audio restoration features including noise reduction and click pop removal.
• Supports sample rates from 6000 to 96000Hz, stereo or mono, 8, 16, 24 or 32 bits.
• Includes its own CD ripper with ‘ultrafast ‘rip mode and cddb music database lookup.
• Works directly with MixPad multi-track audio mixing software.
• Links directly to the Express Burn CD Recorder to burn your sound files to CD.
• Edit tracks for the Zulu DJ software.
• Easy to use interface will get you started editing in just minutes.

Typical Editing Applications

• Software audio editing for studios and professional journalists.
• Edit sound files to broadcast over the internet with the BroadWave Streaming Audio Server
• Normalizing the level of audio files during mastering before buring to CD.
• Editing mp3 files for your iPod, PSP or other portable device.
• As a music editor (includes ringtones creator formats).
• Music editing and recording to produce mp3 files.
• Voice editing for multimedia productions.
• Restoration of audio files including removing excess noise such as hiss and hums.

You can download program from NCH site.

WavePad Sound Editor

But there is one negative thing and that’s memory consumption.

Firefox is known as a big memory eater.

Solution is here and it’s called Firefox ultimate optimizer 2009.

It decrease Firefox memory consumption from 180mb and more to just few mbs.

Here are two pictures of my taskbar and memory consumption of Firefox before and after running optimizer.

You can download it here or visit home page(page is on Spanish) find the new version here.

Before optimizer

After optimizer

Updated on 2009-09-15: old page is dead, so new program link is here.

Yesterday they have published a new tool with symbolic name Desktops.

This tool allows you to have up to 4 virtual desktops with separate systrays and programs on them. Even alt+tab combination doesn’t take programs from another virtual desktops so if you have runned program on one virtual desktop you won’t get it with alt+tab on another one.

Best of all, you can guess, it’s free, with size of only 62kb and you can get it here.