Intrusion Detection with Snort

With over 100,000 installations, the Snort open-source network instrusion detection system is combined with other free tools to deliver IDS defense to medium - to small-sized companies, changing the tradition of intrusion detection being affordable only for large companies with large budgets.

Until now, Snort users had to rely on the official guide available on snort.org. That guide is aimed at relatively experience snort administrators and covers thousands of rules and known exploits.

The lack of usable information made using Snort a frustrating experience. The average Snort user needs to learn how to actually get their systems up-and-running.

Snort Intrusion Detection provides readers with practical guidance on how to put Snort to work. Opening with a primer to intrusion detection and Snort, the book takes the reader through planning an installation to building the server and sensor, tuning the system, implementing the system and analyzing traffic, writing rules, upgrading the system, and extending Snort.

Table of Contents

1. Intrusion Detection Primer.
2. Network Intrusion Detection with Snort.
3. Dissecting Snort.
4. Planning for the Snort Installation.
5. The Foundation-Hardware and Operating Systems.
6. Building the Server.
7. Building the Sensor.
8. Building the Analyst's Console.
9. Additional Installation Methods.
10. Tuning and Reducing False Positives.
11. Real-Time Alerting.
12. Basic Rule Writing.
13. Upgrading and Maintaining Snort.
14. Advanced Topics in Intrusion Prevention.
Appendix A. Troubleshooting.
Appendix B. Rule Documentation.
Index.