Always Learning

Intrusion Detection with SNORT: Advanced IDS Techniques Using SNORT, Apache, MySQL, PHP, and ACID
Rafeeq Ur Rehman

ISBN-10: 0131407333
ISBN-13:  9780131407336

Publisher:  Prentice Hall
Copyright:  2003
Format:  Paper; 288 pp
Published:  05/08/2003
Status: Available on Demand   What's this?


Customers outside the U.S., click here.


Print this content

In this section:


Description

Part of the Bruce Perens' Open Source Series, this book starts with introduction to intrusion detection and covers the five basic areas of Snort: 1)Installation. 2)Managing rules. 3)Managing input and out plugins. 4)Using MySQL with Snort to keep data in a database. 5)Web based user interface (ACID and Snortsnarf) to analyze data generated by Snort. In addition, the book contains appendices to provide information to readers including packet headers, XML DTD and so on.


Table of Contents



1. Introduction to Intrusion Detection and Snort.

What is Intrusion Detection? IDS Policy. Components of Snort. Dealing with Switches. TCP Stream Follow Up. Supported Platforms. How to Protect IDS Itself. References.



2. Installing Snort and Getting Started.

Snort Installation Scenarios. Installing Snort. Running Snort on Multiple Network Interfaces. Snort Command Line Options. Step-By-Step Procedure to Compile and Install Snort From Source Code. Location of Snort Files. Snort Modes. Snort Alert Modes. Running Snort in Stealth Mode. References.



3. Working with Snort Rules.

TCP/IP Network Layers. The First Bad Rule. CIDR. Structure of a Rule. Rule Headers. Rule Options. The Snort Configuration File. Order of Rules Based upon Action. Automatically Updating Snort Rules. Default Snort Rules and Classes. Sample Default Rules. Writing Good Rules. References.



4. Plugins, Preprocessors and Output Modules.

Preprocessors. Output Modules. Using BPF Fileters. References.



5. Using Snort with MySQL.

Making Snort Work with MySQL. Secure Logging to Remote Databases Securely Using Stunnel. Snort Database Maintenance. References.



6. Using ACID and SnortSnarf with Snort.

What is ACID? Installation and Configuration. Using ACID. SnortSnarf. Barnyard. References.



7. Miscellaneous Tools.

SnortSam. IDS Policy Manager. Securing the ACID Web Console. Easy IDS. References.



Appendix A: Introduction to tcpdump.


Appendix B: Getting Started with MySQL.


Appendix C: Packet Header Formats.


Appendix D: Glossary.


Appendix E: SNML DTD.


Index.



Back to top

Print this content

In this section:


Sample Chapter

View a Sample Chapter PDF:/samplechapter/0131407333.pdf


Author Bios

RAFEEQ UR REHMAN is founding director of Argus Network Security Services, Inc. He is an HP Certified System Administrator and CCNA with more than nine years' experience in UNIX and network administration, as well as C and database programming. His books include The Linux Development Platform; Solaris 8 Training Guide (310-043): Network Administrator Certification; and HP Certified: HP-UX System Administration. He is a contributing writer for SysAdmin Journal and Linux Journal.


Backcover Copy

Protect your network with Snort: the high-performance, open source IDS

Snort gives network administrators an open source intrusion detection system that outperforms proprietary alternatives. Now, Rafeeq Ur Rehman explains and simplifies every aspect of deploying and managing Snort in your network. You'll discover how to monitor all your network traffic in real time; update Snort to reflect new security threats; automate and analyze Snort alerts; and more. Best of all, Rehman's custom scripts integrate Snort with Apache, MySQL, PHP, and ACID-so you can build and optimize a complete IDS solution more quickly than ever before.

  • An expert introduction to intrusion detection and the role of Snort
  • Writing and updating Snort rules to reflect the latest attacks and exploits
  • Contains detailed coverage of Snort plug-ins, preprocessors, and output modules
  • Logging alerts to a MySQL database
  • Using ACID to search, process, and analyze security alerts
  • Using SnortSnarf to analyze Snort log files
  • XML support for Snort via the Simple Network Markup Language (SNML)
FTP Site

The accompanying ftp site contains all the software, scripts, and rules you need to get started with Snort.

About the Open Source Series

Bruce Perens' Open Source Series is a definitive series of Linux and Open Source books by the world's leading Linux software developers. Bruce Perens is the primary author of The Open Source Definition, the formative document of the open source movement, and the former Debian GNU/Linux Project Leader. The text of this book is Open Source licensed

Back to top

Print this content

This product is a member of the following series. Click on the series name to see the full list of products in the series.

Back to top

Log in to the Instructor Resource Center

Login name: 

  Password: 

Forgot login/password?  |  Need to redeem an access code?

        

Instructor Resource Center File Download

This work is protected by local and international copyright laws and is provided solely for the use of instructors in teaching their courses and assessing student learning. Dissemination or sale of any part of this work (including on the World Wide Web) will destroy the integrity of the work and is not permitted. The work and materials from this site should never be made available to students except by instructors using the accompanying text in their classes. All recipients of this work are expected to abide by these restrictions and to honor the intended pedagogical purposes and the needs of other instructors who rely on these materials.

Cancel     I accept, proceed with download

Print this content

Pearson Higher Education offers special pricing when you choose to package your text with other student resources. If you're interested in creating a cost-saving package for your students contact your Pearson Higher Education representative.

Back to top