This is the README documentation for the Snort Intrusion Detection Lab, produced and maintained by CodePath.org.
Want to jump into the lab? Navigate to the Part 0 Instructions to get started!
The Snort Intrusion Detection Lab is designed to teach you how a signature-based network intrusion detection system (NIDS) spots an attack on the wire. You'll run Snort 3 against realistic captured traffic, write and tune your own detection rules, and cut down the false positives that bury a real alert. Then you'll switch sides: launch a genuine directory-traversal attack against a vulnerable FTP service, detect it with a rule you write, and use packet analysis to prove exactly which files the attacker read. Snort is pre-compiled in the container, so you spend your time on the skill — not a 30–60 minute build.
- Explain what a signature-based NIDS is and how Snort matches traffic against rules
- Write and tune your own Snort rules — and cut down the false positives that hide a real alert
- Exploit a directory-traversal vulnerability, then detect it on the wire with a
content:"../"rule - Scope a breach from a packet capture — prove exactly which files an attacker accessed
- Setup: Run the lab environment with Docker
- Learn: Run Snort and Write Your First Rule
- Apply: Detect Attack Stages and Tune False Positives
- Challenge: Directory Traversal on the FTP Service
In the provided Docker container, you will find all the necessary tools and dependencies pre-installed. This includes:
snort- Snort 3, pre-compiled and pre-configured (the main focus of this lab)- A starter rule set and practice packet captures in
/opt/snort-lab/ tcpdumpandtcpreplay- for inspecting and replaying captured traffic- A vulnerable FTP service - the directory-traversal target you'll attack and then detect
The lab runs with no outbound network — everything it needs is inside the container.