I am not gifted at all, and don't know to much about nids's or networking, still in a learning phase. I am looking for a easy to read newbie howto, to understanding and setting up snort. All the howto's I have come across have been very technical, and haven't been explained very thorough, would anyone know of any easy to read howto's to snort, for a beginner?

Why not post your questions, and we'll try and help you making it work?

Well I have just installed it; installed libpcap, and snort. And also installed a gui front end too, think it was razorhog, or something like that, to view alerts. But anything more than that I don't know what to do, or what i need to do to get the benefits of snort. All in all I am clueless.

Yeah, Razorback you mean, it's a "tail" kinda app, but then in GTK.

Snort is an IDS, short for Intrusion Detection System.
What you basically will use it for is to monitor traffic, usually towards your systems, for malicious activity like people trying to use an exploit against a service you run to illegally gain access to your systems.

Unlike other "scan detectors" Snort inspects a packet in full, that is the headers plus the contents of the packet. It does this by trying to match any packet attributes to a signature. Signatures are grouped per service in rule files. These rule files are updated regularly, you can download them from Snort.org. If you've read the Snort docs, it mentions commenting out rules in snort.conf for which you have no service running, which will be good for performance.

The minimal way to benefit from running Snort would be to have regular reporting available so you can react to hostilities (or not). For this you could set up a cronjob to mail you the output of helper apps like snort_stat, or you could use Snortsnarf which has a webbased interface for looking at alerts.

Some people use Snort also to actively block traffic from addresses that try to access your system. Snort can do this by itself but it is not recommended. If you want to block traffic based on alerts, have a look at the third party apps in the contrib dir of the Snort tarball, for instance Guardian.

For more info you could try reading the LQ FAQ: Security references, start with post #3 about IDSes.

I have another question, it should be a simple one. When I activate ppp0 how would have snort start automatically, what file would I need to edit? Right now I am running snort every time i dial up from the command line.

I think it would be easiest to let it hook into any if-up post ppp scripts, have a look in /etc/ppp.

if u want to know more : try snort ? I usually use : snort -v

great thanks for you help guys