Application of SNORT and Wireshark in Network Traffic Analysis

Abstract

Now a days, our life is totally dependent on internet which in turn leads to different kind of intrusion. In order to detect intrusion, detection tool is needed so as to detect any kind of intrusion without user involvement. Intrusion detection system is a process of analyzing intrusion so as to provide secured data transmission in networking. One of the most used tools in analyzing packets is Wireshark. Nevertheless, Wireshark is less effective in detecting the intrusion still it can be used to intercept and detect network encrypted traffic which will analyze the captured traffic. Wireshark helps in identifying number of attacks like DoS, DDOS etc. SNORT take all live packets from internet and captured the live packets with predefined rules and if matches didn’t find then directs alert messages to the user. In this method, router is used to access internet so as to get precise flow of data packets. It generates a log file which entails all the live captured packets. The log file “Wi-Fi” generated by SNORT tool is then exported to Wireshark to examine the captured network packets. The Wireshark tool creates each detail about the packets of the recorded log file. In this paper, the I/O graph outlined the flow of the packet which demonstrations the total traffic which is further measured in either bytes or packets per second. TCP errors and delta time graph are shown.