Intrusion Detection Systems with Snort

Download free eBook in PDF about Intrusion Detection Systems with Snort, Advanced IDS Techniques Using Snort, Apache, MySQL, PHP, and ACID.

Table of contents

• Chapter 1 Introduction to Intrusion Detection and Snort
• What is Intrusion Detection?
• Some Definitions
• Where IDS Should be Placed in Network Topology
• Components of Snort
• Dealing with Switches
• TCP Stream Follow Up
• Chapter 2 Installing Snort and Getting Started
• Snort Installation Scenarios
• Installing Snort
• Installing Snort from the RPM Package
• Automatic Startup and Shutdown
• Running Snort on Multiple Network Interfaces
• Snort Command Line Options
• Step-By-Step Procedure to Compile and Install Snort
• From Source Code
• Fast Mode
• Full Mode
• UNIX Socket Mode
• Chapter 3 Working with Snort Rules
• The ack Keyword
• The classtype Keyword
• The uricontent Keyword
• The Snort Configuration File
• Order of Rules Based upon Action
• Automatically Updating Snort Rules
• Writing Good Rules
• References
• Chapter 4 Plugins, Preprocessors and Output Modules
• Preprocessors
• ARP Spoofing
• Output Modules
• The XML Output Module

The book starts with an introduction to intrusion detection and related terminology. You will learn installation and management of Snort as well as other products that work with Snort. These products include MySQL database (http://www.mysql.org) and Analysis Control for Intrusion Database .