Custom Rule-Based Network Traffic Detection Using Snort 3 | Cyber Security Demo

In this video, I demonstrate how Snort 3 can be used as a Network Intrusion Detection System (IDS) to monitor network traffic and generate alerts using custom rules. The demonstration is performed on Kali Linux, with a separate Windows PC generating test traffic. It covers Snort installation verification, configuration files, network configuration, custom rule creation, configuration validation, and live traffic monitoring. *Topics covered:* Introduction to Snort 3 and IDS vs IPS Understanding the Snort workflow and sensor placement Exploring `snort.lua` and `local.rules` Configuring `HOME_NET` Creating six custom rules for ICMP, SSH, FTP, HTTP, TCP SYN, and UDP traffic Validating the Snort configuration Generating test traffic using Windows Command Prompt, `ping`, and Nmap Observing and interpreting Snort alerts Understanding the limitations of broad detection rules This practical demonstration helped me understand how Snort rules match network packets and how alerts can be used for network security monitoring. An alert indicates a rule match and does not automatically prove malicious activity or a successful connection. *Tools used:* Snort 3, Kali Linux, Nmap, Windows Command Prompt, Xournal++, and OBS Studio. *Author:* Gaurish Budhiraja *Institution:* Vellore Institute of Technology, Chennai *Course:* Cyber Security #Snort3 #CyberSecurity #NetworkSecurity #IDS #KaliLinux #Nmap #IntrusionDetection