IDS Using Cisco Packet trainer

Summary

This project demonstrates the implementation of an Intrusion Detection System (IDS) to protect network infrastructure. It includes both Network Intrusion Detection (NID) and Host Intrusion Detection (HID), aimed at monitoring suspicious activities and enforcing network policies. The setup involves three interconnected networks with devices like PCs, servers, and printers. HTTP and FTP servers are also configured for testing. The IDS ensures only authorized communication within the network, blocking external access attempts. The system successfully detects and logs intrusions, providing a secure and controlled environment against external threats.

Takeaways

• 😀 The project demonstrates the setup and functionality of an Intrusion Detection System (IDS) to monitor network activities and prevent security breaches.
• 😀 IDS is categorized into two main types: Network Intrusion Detection System (NIDS) and Host Intrusion Detection System (HIDS), each focusing on different aspects of network and host security.
• 😀 The network configuration includes three distinct networks, each with different IP address ranges, devices like PCs, servers, printers, and routers for connectivity.
• 😀 The first network uses IP addresses in the range of 192.168.1.2 - 192.168.1.7 and is connected to a Cisco 1941 router for communication.
• 😀 The second network (IP range 192.168.10.2 - 192.168.10.8) includes a TFTP server, laptops, PCs, and a printer to ensure diverse device interaction.
• 😀 The third network includes external devices such as smartphones and laptops, designed to test access restrictions from outside the internal network.
• 😀 HTTP and FTP servers are set up for file hosting and transfer, with an HTML file on the HTTP server and a test file uploaded to the FTP server for network access tests.
• 😀 The test process includes checking connectivity between devices (e.g., pinging between PCs) to ensure proper network setup and communication.
• 😀 IDS functionality is tested by attempting access from external devices (e.g., a PC from Network 3) to internal systems. The IDS successfully blocks unauthorized access, confirming its effectiveness.
• 😀 Syslog entries capture and log intrusion attempts, providing crucial monitoring and reporting capabilities for network administrators to track and respond to security events.

Q & A

What is the purpose of the Intrusion Detection System (IDS) in this project?

The purpose of the IDS in this project is to monitor suspicious network activities or violations of policy and ensure that unauthorized access is prevented while internal communication remains functional.

What are the two main categories of Intrusion Detection Systems (IDS)?

The two main categories of IDS are Network Intrusion Detection (NID) and Host Intrusion Detection (HID).

How is the network structured in this project?

The network is structured into three segments, each with different IP address ranges: 192.168.1.x, 192.168.10.x, and a third network with a mix of laptops and mobile devices. Each network is connected via switches and routers, with various devices like PCs, printers, and servers placed within them.

What role does the HTTP server play in the network setup?

The HTTP server hosts HTML files that can be accessed by any PC or device on the network. It provides a way for users to view files through a web browser by entering the server's IP address.

How is file transfer handled through the FTP server?

File transfer on the FTP server is handled by uploading files from a PC to the server using FTP commands. Users can then access these files from other devices on the network by connecting to the FTP server with the correct credentials.

What happens when PC3 tries to ping devices inside its network?

PC3 can successfully ping devices within its own network and communicate with them. The network's configuration ensures internal devices can communicate with each other without issues.

Can devices outside the network access internal resources, according to the IDS setup?

No, the IDS is designed to prevent devices outside the network from accessing internal resources. For example, PC10, located outside the network, cannot ping or connect to PC3 inside the network.

What role does the router play in the IDS configuration?

The router plays a crucial role in the IDS configuration by applying the IDS settings to monitor network traffic and prevent unauthorized access. The router ensures that communication between internal devices is allowed, while blocking external devices from entering the network.

How is the syslog used in the IDS system?

The syslog is used to log events and alert administrators to any intrusion attempts or suspicious activities on the network. When unauthorized devices attempt to access the network, the syslog records these events for further analysis.

What is the significance of the FTP server's ability to restrict access from external devices?

The FTP server's ability to restrict access from external devices ensures the security of sensitive files stored on the server. Only authorized devices within the network can upload, download, or interact with the files, preventing unauthorized access from outside sources.