1. Obtain a copy of the 1.7x gig compressed VM image of the Cisco MARS software someone on the net. I'm currently working on getting it up on rapidshare myself but this is going to take a little time.
2. Install VMWare if you do not have it installed already.
3. Extract the compressed vmdk
4. Open VMWare then open the uncompressed VMDK
5. On the new machine settings make sure that the network connection is in bridged mode.
6. The VM image of the CS-MARS software will take a little while to load. Eventually you will be prompted for a username and password. At this prompt enter "pnadmin" for the username and "pnadmin" for the password. Hit enter.
7. Hit ? to view the CLI configuration options.
8. Type "ifconfig eth0 [ip address] [ netmask], where IP address is a unique IP on the subnet you're connected to.
9. When you hit enter you will be prompted to reboot. Hit Y then hit enter to reboot.
10. Once the VM reboots log in with the same credentials and set a hostname using the "hostname [hostname]" command. When you hit enter you will again be prompted to reboot. Hit Y then enter to reboot.
11. Once the VM reboots log into the VM yet again and set an administrator password if you want. I left the admin password the default so I don't know if you have to reboot after this or not.
12. At this point you should be able to access the device using SSH in a web browser. In my experience Cisco web apps work better in Internet Explorer, so that is what I use.
13. Open the web browser and go to https://the.ip.ofthe.vm_image
and hit enter.
14. You will be prompted for your username and password. Enter the username and password then log in.
15. At the next screen you will be prompted for a product key. You do not have to enter a valid key, just zero it out with 1's or any other made up key. For example, I registered my product with "11111-11111-11111-11111-11111-11111". Validate the product and you will be taken to the product configuration page. Enter the apropriate configuration details (smtp info etc) and hit update.
16. The MARS VM will reboot one more time. You can watch it reboot in the VMWare software. This is actually my favorite part of emulating MARS. You can really see how it works on both the CLI and GUI levels, which I think is very important.
16. Enjoy experimenting with MARS
for download custom parsers, rules, report templates and other packages.