You are previewing Intrusion Detection Systems with Snort: Advanced IDS Techniques Using Snort, Apache, MySQL, PHP, and ACID.
O'Reilly logo
Intrusion Detection Systems with Snort: Advanced IDS Techniques Using Snort, Apache, MySQL, PHP, and ACID

Book Description

Protect your network with Snort: the high-performance, open source IDS

Snort gives network administrators an open source intrusion detection system that outperforms proprietary alternatives. Now, Rafeeq Ur Rehman explains and simplifies every aspect of deploying and managing Snort in your network. You'll discover how to monitor all your network traffic in real time; update Snort to reflect new security threats; automate and analyze Snort alerts; and more. Best of all, Rehman's custom scripts integrate Snort with Apache, MySQL, PHP, and ACID-so you can build and optimize a complete IDS solution more quickly than ever before.

  • An expert introduction to intrusion detection and the role of Snort

  • Writing and updating Snort rules to reflect the latest attacks and exploits

  • Contains detailed coverage of Snort plug-ins, preprocessors, and output modules

  • Logging alerts to a MySQL database

  • Using ACID to search, process, and analyze security alerts

  • Using SnortSnarf to analyze Snort log files

  • XML support for Snort via the Simple Network Markup Language (SNML)

  • FTP Site

    The accompanying ftp site contains all the software, scripts, and rules you need to get started with Snort.

    About the Open Source Series

    Bruce Perens' Open Source Series is a definitive series of Linux and Open Source books by the world's leading Linux software developers. Bruce Perens is the primary author of The Open Source Definition, the formative document of the open source movement, and the former Debian GNU/Linux Project Leader. The text of this book is Open Source licensed

    Table of Contents

    1. Copyright
    2. Bruce Perens' Open Source Series
    3. Introduction to Intrusion Detection and Snort
      1. What is Intrusion Detection?
      2. IDS Policy
      3. Components of Snort
      4. Dealing with Switches
      5. TCP Stream Follow Up
      6. Supported Platforms
      7. How to Protect IDS Itself
      8. References
    4. Installing Snort and Getting Started
      1. Snort Installation Scenarios
      2. Installing Snort
      3. Running Snort on Multiple Network Interfaces
      4. Snort Command Line Options
      5. Step-By-Step Procedure to Compile and Install Snort From Source Code
      6. Location of Snort Files
      7. Snort Modes
      8. Snort Alert Modes
      9. Running Snort in Stealth Mode
      10. References
    5. Working with Snort Rules
      1. TCP/IP Network Layers
      2. The First Bad Rule
      3. CIDR
      4. Structure of a Rule
      5. Rule Headers
      6. Rule Options
      7. The Snort Configuration File
      8. Order of Rules Based upon Action
      9. Automatically Updating Snort Rules
      10. Default Snort Rules and Classes
      11. Sample Default Rules
      12. Writing Good Rules
      13. References
    6. Plugins, Preprocessors and Output Modules
      1. Preprocessors
      2. Output Modules
      3. Using BPF Fileters
      4. References
    7. Using Snort with MySQL
      1. Making Snort Work with MySQL
      2. Secure Logging to Remote Databases Securely Using Stunnel
      3. Snort Database Maintenance
      4. References
    8. Using ACID and SnortSnarf with Snort
      1. What is ACID?
      2. Installation and Configuration
      3. Using ACID
      4. SnortSnarf
      5. Barnyard
      6. References
    9. Miscellaneous Tools
      1. SnortSam
      2. IDS Policy Manager
      3. Securing the ACID Web Console
      4. Easy IDS
      5. References
    10. Introduction to tcpdump
    11. Getting Started with MySQL
      1. For New Users of MySQL
    12. Packet Header Formats
      1. IP Packet Header
      2. ICMP Packet Header
      3. TCP Packet Header
      4. UDP Packet Header
      5. ARP Packet Header
    13. Glossary
      1. Glossary
    14. SNML DTD