Preface |
|
vii | |
|
Installation and Optimization |
|
|
1 | (50) |
|
Installing Snort from Source on Unix |
|
|
1 | (3) |
|
Installing Snort Binaries on Linux |
|
|
4 | (1) |
|
Installing Snort on Solaris |
|
|
5 | (2) |
|
Installing Snort on Windows |
|
|
7 | (5) |
|
Uninstalling Snort from Windows |
|
|
12 | (2) |
|
Installing Snort on Mac OS X |
|
|
14 | (2) |
|
Uninstalling Snort from Linux |
|
|
16 | (1) |
|
|
17 | (1) |
|
Monitoring Multiple Network Interfaces |
|
|
17 | (2) |
|
|
19 | (1) |
|
Invisibly Sniffing Between Two Network Points |
|
|
19 | (2) |
|
Invisibly Sniffing 100 MB Ethernet |
|
|
21 | (1) |
|
Sniffing Gigabit Ethernet |
|
|
22 | (1) |
|
Tapping a Wireless Network |
|
|
23 | (1) |
|
Positioning Your IDS Sensors |
|
|
24 | (3) |
|
Capturing and Viewing Packets |
|
|
27 | (3) |
|
Logging Packets That Snort Captures |
|
|
30 | (3) |
|
Running Snort to Detect Intrusions |
|
|
33 | (2) |
|
Reading a Saved Capture File |
|
|
35 | (1) |
|
Running Snort as a Linux Daemon |
|
|
36 | (1) |
|
Running Snort as a Windows Service |
|
|
37 | (2) |
|
Capturing Without Putting the Interface into Promiscuous Mode |
|
|
39 | (1) |
|
|
39 | (1) |
|
|
40 | (1) |
|
Building a Distributed IDS (Plain Text) |
|
|
41 | (3) |
|
Building a Distributed IDS (Encrypted) |
|
|
44 | (7) |
|
Logging, Alerts, and Output Plug-ins |
|
|
51 | (39) |
|
Logging to a File Quickly |
|
|
51 | (1) |
|
|
52 | (2) |
|
|
54 | (2) |
|
Logging to a Specific File |
|
|
56 | (1) |
|
Logging to Multiple Locations |
|
|
56 | (2) |
|
|
58 | (2) |
|
Viewing Traffic While Logging |
|
|
60 | (1) |
|
|
61 | (2) |
|
Logging to the Windows Event Viewer |
|
|
63 | (1) |
|
Logging Alerts to a Database |
|
|
64 | (1) |
|
Installing and Configuring MySQL |
|
|
65 | (2) |
|
Configuring MySQL for Snort |
|
|
67 | (3) |
|
Using PostgreSQL with Snort and ACID |
|
|
70 | (4) |
|
Logging in PCAP Format (TCPDump) |
|
|
74 | (1) |
|
|
75 | (2) |
|
Logging to a Pager or Cell Phone |
|
|
77 | (1) |
|
|
78 | (2) |
|
Reading Unified Logged Data |
|
|
80 | (1) |
|
Generating Real-Time Alerts |
|
|
81 | (1) |
|
|
82 | (1) |
|
Logging to System Logfiles |
|
|
82 | (1) |
|
|
83 | (1) |
|
|
84 | (2) |
|
|
86 | (1) |
|
|
87 | (1) |
|
Capturing Traffic from a Specific TCP Session |
|
|
88 | (1) |
|
Killing a Specific Session |
|
|
89 | (1) |
|
|
90 | (35) |
|
|
90 | (4) |
|
Keeping the Rules Up to Date |
|
|
94 | (4) |
|
Basic Rules You Shouldn't Leave Home Without |
|
|
98 | (2) |
|
|
100 | (2) |
|
|
102 | (1) |
|
|
103 | (1) |
|
|
104 | (1) |
|
|
105 | (2) |
|
|
107 | (3) |
|
|
110 | (4) |
|
Countermeasures from Rules |
|
|
114 | (1) |
|
|
115 | (1) |
|
|
116 | (1) |
|
Blocking Attacks in Real Time |
|
|
117 | (1) |
|
|
118 | (1) |
|
|
118 | (1) |
|
|
119 | (1) |
|
Carrying Out Statistical Analysis |
|
|
120 | (5) |
|
Preprocessing: An Introduction |
|
|
125 | (32) |
|
Detecting Stateless Attacks and Stream Reassembly |
|
|
126 | (5) |
|
Detecting Fragmentation Attacks and Fragment Reassembly with Frag2 |
|
|
131 | (5) |
|
Detecting and Normalizing HTTP Traffic |
|
|
136 | (5) |
|
Decoding Application Traffic |
|
|
141 | (1) |
|
Detecting Port Scans and Talkative Hosts |
|
|
142 | (7) |
|
Getting Performance Metrics |
|
|
149 | (6) |
|
Experimental Preprocessors |
|
|
155 | (1) |
|
Writing Your Own Preprocessor |
|
|
156 | (1) |
|
|
157 | (46) |
|
|
157 | (2) |
|
Installing and Configuring IDScenter |
|
|
159 | (8) |
|
Installing and Configuring SnortCenter |
|
|
167 | (6) |
|
Installing and Configuring Snortsnarf |
|
|
173 | (2) |
|
Running Snortsnarf Automatically |
|
|
175 | (1) |
|
Installing and Configuring ACID |
|
|
175 | (5) |
|
|
180 | (1) |
|
Installing and Configuring Swatch |
|
|
181 | (2) |
|
Installing and Configuring Barnyard |
|
|
183 | (1) |
|
Administering Snort with IDS Policy Manager |
|
|
184 | (6) |
|
Integrating Snort with Webmin |
|
|
190 | (6) |
|
Administering Snort with Hen Wen |
|
|
196 | (5) |
|
Newbies Playing with Snort Using EagleX |
|
|
201 | (2) |
|
|
203 | (22) |
|
Generating Statistical Output from Snort Logs |
|
|
203 | (4) |
|
Generating Statistical Output from Snort Databases |
|
|
207 | (1) |
|
Performing Real-Time Data Analysis |
|
|
208 | (4) |
|
Generating Text-Based Log Analysis |
|
|
212 | (2) |
|
Creating HTML Log Analysis Output |
|
|
214 | (1) |
|
Tools for Testing Signatures |
|
|
215 | (5) |
|
Analyzing and Graphing Logs |
|
|
220 | (3) |
|
Analyzing Sniffed (Pcap) Traffic |
|
|
223 | (1) |
|
|
224 | (1) |
|
|
225 | (40) |
|
Monitoring Network Performance |
|
|
225 | (8) |
|
Logging Application Traffic |
|
|
233 | (1) |
|
Recognizing HTTP Traffic on Unusual Ports |
|
|
234 | (1) |
|
|
235 | (3) |
|
Monitoring a Network Using Policy-Based IDS |
|
|
238 | (2) |
|
|
240 | (3) |
|
|
243 | (1) |
|
Passive OS Fingerprinting |
|
|
244 | (6) |
|
Working with Honeypots and Honeynets |
|
|
250 | (2) |
|
Performing Forensics Using Snort |
|
|
252 | (1) |
|
|
253 | (4) |
|
Snort as Legal Evidence in the U.S. |
|
|
257 | (1) |
|
Snort as Evidence in the U.K. |
|
|
258 | (2) |
|
Snort as a Virus Detection Tool |
|
|
260 | (3) |
|
|
263 | (2) |
Index |
|
265 | |