Snort Cookbook

Spis treści ebooka

• Snort Cookbook
• Preface
  • Audience
  • Contents of This Book
  • Conventions Used in This Book
  • Using Code Examples
  • Safari Enabled
  • How to Contact Us
  • Acknowledgments
• 1. Installation and Optimization
  • Introduction
  • 1.1. Installing Snort from Source on Unix
  • 1.2. Installing Snort Binaries on Linux
  • 1.3. Installing Snort on Solaris
  • 1.4. Installing Snort on Windows
  • 1.5. Uninstalling Snort from Windows
  • 1.6. Installing Snort on Mac OS X
  • 1.7. Uninstalling Snort from Linux
  • 1.8. Upgrading Snort on Linux
  • 1.9. Monitoring Multiple Network Interfaces
  • 1.10. Invisibly Tapping a Hub
  • 1.11. Invisibly Sniffing Between Two Network Points
  • 1.12. Invisibly Sniffing 100 MB Ethernet
  • 1.13. Sniffing Gigabit Ethernet
  • 1.14. Tapping a Wireless Network
  • 1.15. Positioning Your IDS Sensors
  • 1.16. Capturing and Viewing Packets
  • 1.17. Logging Packets That Snort Captures
  • 1.18. Running Snort to Detect Intrusions
  • 1.19. Reading a Saved Capture File
  • 1.20. Running Snort as a Linux Daemon
  • 1.21. Running Snort as a Windows Service
  • 1.22. Capturing Without Putting the Interface into Promiscuous Mode
  • 1.23. Reloading Snort Settings
  • 1.24. Debugging Snort Rules
  • 1.25. Building a Distributed IDS (Plain Text)
  • 1.26. Building a Distributed IDS (Encrypted)
• 2. Logging, Alerts, and Output Plug-ins
  • Introduction
  • 2.1. Logging to a File Quickly
  • 2.2. Logging Only Alerts
  • 2.3. Logging to a CSV File
  • 2.4. Logging to a Specific File
  • 2.5. Logging to Multiple Locations
  • 2.6. Logging in Binary
  • 2.7. Viewing Traffic While Logging
  • 2.8. Logging Application Data
  • 2.9. Logging to the Windows Event Viewer
  • 2.10. Logging Alerts to a Database
  • 2.11. Installing and Configuring MySQL
  • 2.12. Configuring MySQL for Snort
  • 2.13. Using PostgreSQL with Snort and ACID
  • 2.14. Logging in PCAP Format (TCPDump)
  • 2.15. Logging to Email
  • 2.16. Logging to a Pager or Cell Phone
  • 2.17. Optimizing Logging
  • 2.18. Reading Unified Logged Data
  • 2.19. Generating Real-Time Alerts
  • 2.20. Ignoring Some Alerts
  • 2.21. Logging to System Logfiles
  • 2.22. Fast Logging
  • 2.23. Logging to a Unix Socket
  • 2.24. Not Logging
  • 2.25. Prioritizing Alerts
  • 2.26. Capturing Traffic from a Specific TCP Session
  • 2.27. Killing a Specific Session
• 3. Rules and Signatures
  • Introduction
  • 3.1. How to Build Rules
  • 3.2. Keeping the Rules Up to Date
  • 3.3. Basic Rules You Shouldnt Leave Home Without
  • 3.4. Dynamic Rules
  • 3.5. Detecting Binary Content
  • 3.6. Detecting Malware
  • 3.7. Detecting Viruses
  • 3.8. Detecting IM
  • 3.9. Detecting P2P
  • 3.10. Detecting IDS Evasion
  • 3.11. Countermeasures from Rules
  • 3.12. Testing Rules
  • 3.13. Optimizing Rules
  • 3.14. Blocking Attacks in Real Time
  • 3.15. Suppressing Rules
  • 3.16. Thresholding Alerts
  • 3.17. Excluding from Logging
  • 3.18. Carrying Out Statistical Analysis
• 4. Preprocessing: An Introduction
  • Introduction
  • 4.1. Detecting Stateless Attacks and Stream Reassembly
  • 4.2. Detecting Fragmentation Attacks and Fragment Reassembly with Frag2
  • 4.3. Detecting and Normalizing HTTP Traffic
  • 4.4. Decoding Application Traffic
  • 4.5. Detecting Port Scans and Talkative Hosts
  • 4.6. Getting Performance Metrics
  • 4.7. Experimental Preprocessors
  • 4.8. Writing Your Own Preprocessor
• 5. Administrative Tools
  • Introduction
  • 5.1. Managing Snort Sensors
  • 5.2. Installing and Configuring IDScenter
  • 5.3. Installing and Configuring SnortCenter
  • 5.4. Installing and Configuring Snortsnarf
  • 5.5. Running Snortsnarf Automatically
  • 5.6. Installing and Configuring ACID
  • 5.7. Securing ACID
  • 5.8. Installing and Configuring Swatch
  • 5.9. Installing and Configuring Barnyard
  • 5.10. Administering Snort with IDS Policy Manager
  • 5.11. Integrating Snort with Webmin
  • 5.12. Administering Snort with HenWen
  • 5.13. Newbies Playing with Snort Using EagleX
• 6. Log Analysis
  • Introduction
  • 6.1. Generating Statistical Output from Snort Logs
  • 6.2. Generating Statistical Output from Snort Databases
  • 6.3. Performing Real-Time Data Analysis
  • 6.4. Generating Text-Based Log Analysis
  • 6.5. Creating HTML Log Analysis Output
  • 6.6. Tools for Testing Signatures
  • 6.7. Analyzing and Graphing Logs
  • 6.8. Analyzing Sniffed (Pcap) Traffic
  • 6.9. Writing Output Plug-ins
• 7. Miscellaneous Other Uses
  • Introduction
  • 7.1. Monitoring Network Performance
  • 7.2. Logging Application Traffic
  • 7.3. Recognizing HTTP Traffic on Unusual Ports
  • 7.4. Creating a Reactive IDS
  • 7.5. Monitoring a Network Using Policy-Based IDS
  • 7.6. Port Knocking
  • 7.7. Obfuscating IP Addresses
  • 7.8. Passive OS Fingerprinting
  • 7.9. Working with Honeypots and Honeynets
  • 7.10. Performing Forensics Using Snort
  • 7.11. Snort and Investigations
  • 7.12. Snort as Legal Evidence in the U.S.
  • 7.13. Snort as Evidence in the U.K.
  • 7.14. Snort as a Virus Detection Tool
  • 7.15. Staying Legal
• Index
• About the Authors
• Colophon
• Copyright

pokaż cały spis treści

ukryj recenzje