If you are a network administrator, you're under a lot of pressure to ensure that mission-critical systems are completely safe from malicious code, buffer overflows, stealth port scans, SMB probes, OS fingerprinting attempts, CGI attacks, and other network intruders. Designing a reliable way to detect intruders before they get in is an essential--but often overwhelming--challenge. Snort, the defacto open source standard of intrusion detection tools, is capable of performing real-time traffic analysis and packet logging on IP network. It can perform protocol analysis, content searching, and matching. Snort can save countless headaches; the new Snort Cookbook will save countless hours of sifting through dubious online advice or wordy tutorials in order to leverage the full power of SNORT.
Each recipe in the popular and practical problem-solution-discussion O'Reilly cookbook format contains a clear and thorough description of the problem, a concise but complete discussion of a solution, and real-world examples that illustrate that solution. The Snort Cookbook covers important issues that sys admins and security pros will us everyday, such as:
rules and signatures
detecting common attacks
But the Snort Cookbook offers far more than quick cut-and-paste solutions to frustrating security issues. Those who learn best in the trenches--and don't have the hours to spare to pore over tutorials or troll online for best-practice snippets of advice--will find that the solutions offered in this ultimate Snort sourcebook not only solve immediate problems quickly, but also showcase the best tips and tricks they need to master be security gurus--and still have a life.
Chapter 1 Installation and Optimization
Installing Snort from Source on Unix
Installing Snort Binaries on Linux
Installing Snort on Solaris
Installing Snort on Windows
Uninstalling Snort from Windows
Installing Snort on Mac OS X
Uninstalling Snort from Linux
Upgrading Snort on Linux
Monitoring Multiple Network Interfaces
Invisibly Tapping a Hub
Invisibly Sniffing Between Two Network Points
Invisibly Sniffing 100 MB Ethernet
Sniffing Gigabit Ethernet
Tapping a Wireless Network
Positioning Your IDS Sensors
Capturing and Viewing Packets
Logging Packets That Snort Captures
Running Snort to Detect Intrusions
Reading a Saved Capture File
Running Snort as a Linux Daemon
Running Snort as a Windows Service
Capturing Without Putting the Interface into Promiscuous Mode
Reloading Snort Settings
Debugging Snort Rules
Building a Distributed IDS (Plain Text)
Building a Distributed IDS (Encrypted)
Chapter 2 Logging, Alerts, and Output Plug-ins
Logging to a File Quickly
Logging Only Alerts
Logging to a CSV File
Logging to a Specific File
Logging to Multiple Locations
Logging in Binary
Viewing Traffic While Logging
Logging Application Data
Logging to the Windows Event Viewer
Logging Alerts to a Database
Installing and Configuring MySQL
Configuring MySQL for Snort
Using PostgreSQL with Snort and ACID
Logging in PCAP Format (TCPDump)
Logging to Email
Logging to a Pager or Cell Phone
Reading Unified Logged Data
Generating Real-Time Alerts
Ignoring Some Alerts
Logging to System Logfiles
Logging to a Unix Socket
Capturing Traffic from a Specific TCP Session
Killing a Specific Session
Chapter 3 Rules and Signatures
How to Build Rules
Keeping the Rules Up to Date
Basic Rules You Shouldn't Leave Home Without
Detecting Binary Content
Detecting IDS Evasion
Countermeasures from Rules
Blocking Attacks in Real Time
Excluding from Logging
Carrying Out Statistical Analysis
Chapter 4 Preprocessing: An Introduction
Detecting Stateless Attacks and Stream Reassembly
Detecting Fragmentation Attacks and Fragment Reassembly with Frag2
Detecting and Normalizing HTTP Traffic
Decoding Application Traffic
Detecting Port Scans and Talkative Hosts
Getting Performance Metrics
Writing Your Own Preprocessor
Chapter 5 Administrative Tools
Managing Snort Sensors
Installing and Configuring IDScenter
Installing and Configuring SnortCenter
Installing and Configuring Snortsnarf
Running Snortsnarf Automatically
Installing and Configuring ACID
Installing and Configuring Swatch
Installing and Configuring Barnyard
Administering Snort with IDS Policy Manager
Integrating Snort with Webmin
Administering Snort with HenWen
Newbies Playing with Snort Using EagleX
Chapter 6 Log Analysis
Generating Statistical Output from Snort Logs
Generating Statistical Output from Snort Databases
Angela Orebaugh is an information security technologist, scientist, and author with a broad spectrum of expertise in information assurance. She synergizes her 15 years of hands-on experiences within industry, academia, and government to advise clients on information assurance strategy, management, and technologies.
Ms. Orebaugh is involved in several security initiatives with the National Institute of Standards and Technology (NIST), including technical Special Publications (800 series), the National Vulnerability Database (NVD), Security Content Automation Protocol (SCAP) project, and secure eVoting.
Ms. Orebaugh is an Adjunct Professor for George Mason University where she performs research and teaching in intrusion detection and forensics. She developed and teaches the Intrusion Detection curriculum, a core requirement for the Forensics program in the Department of Electrical and Computer Engineering. Her current research interests include peer-reviewed publications in the areas of intrusion detection and prevention, data mining, attacker profiling, user behavior analysis, and network forensics.
Ms. Orebaugh is the author of the Syngress best seller's Nmap in the Enterprise, Wireshark and Ethereal Network Protocol Analyzer Toolkit, and Ethereal Packet Sniffing. She has also co-authored the Snort Cookbook, Intrusion Prevention and Active Response, and How to Cheat at Configuring Open Source Security Tools. Angela is a frequent speaker at a variety of security conferences and technology events, including the SANS Institute and The Institute for Applied Network Security.
Ms. Orebaugh holds a Masters degree in Computer Science and a Bachelors degree in Computer Information Systems from James Madison University. She is currently completing her dissertation for her Ph.D. at George Mason University, with a concentration in Information Security.
Simon Biles is currently Director of Thinking Security Ltd. an Information Security Consultancy based near Oxford in the UK. The company deals with all aspects of InfoSec from Incident Response and Forensics through to ISO 27001 work. He is currently studying for his MSc in Forensic Computing at Shrivenham with Cranfield University. He holds a CISSP, is Certified as an ISO17799 Lead Auditor, is a Chartered IT Professional with the British Computer Society and is also a member of F3 - the UK's First Forensic Forum. Currently he is involved in a project to define and support best practices in Forensics - you can find out more about this at the Open Forensics Group.
Jake Babbin works as a contractor with a government agency filling the role of Intrusion Detection Team Lead. He has worked in both private industry as a security professional and in government space in a variety of IT security roles. He is a speaker at several IT security conferences and is a frequent assistant in SANS Security Essentials Bootcamp, Incident Handling and Forensics courses. Jake lives in Virginia.
Our look is the result of reader comments, our own experimentation, and feedback from distribution channels. Distinctive covers complement our distinctive approach to technical topics, breathing personality and life into potentially dry subjects. The image on the cover of Snort Cookbook is of a charging soldier clad in traditional Scottish military dress. In 1747, the Act for the Abolition of Highland Dress provided that no man or boy in Scotland, except officers and soldiers, could wear clothes commonly called Highland garb. Specifically, this meant plaid, philabeg, or little kilt, trews, and shoulderbelt. Some historians record that, immediately after this act was passed, orders were given to kill on the spot anyone dressed in this fashion. However, since Highland regiments had a widespread reputation for their agility, bravery, and heroism, especially during the Napoleonic Wars, the tartan soon became imbued with new prestige and glamour. In fact, Highlanders made such a great impression on their enemies that it was said the French believed there were twelve battalions of them in the British army, instead of two.
The weapon carried by the soldier in this image is a bayonet. Although generally considered the infantryman's assault weapon, this instrument was originally intended for defense. With the combined length of the musket and bayonet, infantry standing two and three deep could hold their ground against a sudden rush of cavalry. Adam Witwer was the production editor, and Linley Dolby was the copyeditor for Snort Cookbook. Lydia Onofrei performed the source check. Ann Schirmer proofread the text. Sarah Sherman and Claire Cloutier provided quality control. Lucie Haskins wrote the index.
Emma Colby designed the cover of this book, based on a series design by Edie Freedman. The cover image is a 19th-century engraving from the Dover Pictorial Archive. Karen Montgomery produced the cover layout with Adobe InDesign CS using Adobe's ITC Garamond font.
David Futato designed the interior layout. This book was converted by Judy Hoer to FrameMaker 5.5.6 with a format conversion tool created by Erik Ray, Jason McIntosh, Neil Walls, and Mike Sierra that uses Perl and XML technologies. The text font is Linotype Birka; the heading font is Adobe Myriad Condensed; and the code font is LucasFont's TheSans Mono Condensed. The illustrations that appear in the book were produced by Robert Romano, Jessamyn Read, and Lesley Borash using Macromedia FreeHand MX and Adobe Photoshop CS. The tip and warning icons were drawn by Christopher Bing. This colophon was written by Lydia Onofrei.