Snort Cookbook - page 1
- Snort Cookbook
- Snort Cookbook
- Table of Contents
- Copyright
- Preface
- Audience
- Contents of This Book
- Conventions Used in This Book
- Using Code Examples
- Safari Enabled
- How to Contact Us
- Acknowledgments
- Chapter 1. Installation and Optimization
- Introduction
- Recipe 1.1. Installing Snort from Source on Unix
- Recipe 1.2. Installing Snort Binaries on Linux
- Recipe 1.3. Installing Snort on Solaris
- Recipe 1.4. Installing Snort on Windows
- Recipe 1.5. Uninstalling Snort from Windows
- Recipe 1.6. Installing Snort on Mac OS X
- Recipe 1.7. Uninstalling Snort from Linux
- Recipe 1.8. Upgrading Snort on Linux
- Recipe 1.9. Monitoring Multiple Network Interfaces
- Recipe 1.10. Invisibly Tapping a Hub
- Recipe 1.11. Invisibly Sniffing Between Two Network Points
- Recipe 1.12. Invisibly Sniffing 100 MB Ethernet
- Recipe 1.13. Sniffing Gigabit Ethernet
- Recipe 1.14. Tapping a Wireless Network
- Recipe 1.15. Positioning Your IDS Sensors
- Recipe 1.16. Capturing and Viewing Packets
- Recipe 1.17. Logging Packets That Snort Captures
- Recipe 1.18. Running Snort to Detect Intrusions
- Recipe 1.19. Reading a Saved Capture File
- Recipe 1.20. Running Snort as a Linux Daemon
- Recipe 1.21. Running Snort as a Windows Service
- Recipe 1.22. Capturing Without Putting the Interface into Promiscuous Mode
- Recipe 1.23. Reloading Snort Settings
- Recipe 1.24. Debugging Snort Rules
- Recipe 1.25. Building a Distributed IDS (Plain Text)
- Recipe 1.26. Building a Distributed IDS (Encrypted)
- Chapter 2. Logging, Alerts, and Output Plug-ins
- Introduction
- Recipe 2.1. Logging to a File Quickly
- Recipe 2.2. Logging Only Alerts
- Recipe 2.3. Logging to a CSV File
- Recipe 2.4. Logging to a Specific File
- Recipe 2.5. Logging to Multiple Locations
- Recipe 2.6. Logging in Binary
- Recipe 2.7. Viewing Traffic While Logging
- Recipe 2.8. Logging Application Data
- Recipe 2.9. Logging to the Windows Event Viewer
- Recipe 2.10. Logging Alerts to a Database
- Recipe 2.11. Installing and Configuring MySQL
- Recipe 2.12. Configuring MySQL for Snort
- Recipe 2.13. Using PostgreSQL with Snort and ACID
- Recipe 2.14. Logging in PCAP Format (TCPDump)
- Recipe 2.15. Logging to Email
- Recipe 2.16. Logging to a Pager or Cell Phone
- Recipe 2.17. Optimizing Logging
- Recipe 2.18. Reading Unified Logged Data
- Recipe 2.19. Generating Real-Time Alerts
- Recipe 2.20. Ignoring Some Alerts
- Recipe 2.21. Logging to System Logfiles
- Recipe 2.22. Fast Logging
- Recipe 2.23. Logging to a Unix Socket
- Recipe 2.24. Not Logging
- Recipe 2.25. Prioritizing Alerts
- Recipe 2.26. Capturing Traffic from a Specific TCP Session
- Recipe 2.27. Killing a Specific Session
- Chapter 3. Rules and Signatures
- Recipe 3.1. How to Build Rules
- Recipe 3.2. Keeping the Rules Up to Date
- Recipe 3.3. Basic Rules You Shouldn t Leave Home Without
- Recipe 3.4. Dynamic Rules
- Recipe 3.5. Detecting Binary Content
- Recipe 3.6. Detecting Malware
- Recipe 3.7. Detecting Viruses
- Recipe 3.8. Detecting IM
- Recipe 3.9. Detecting P2P
- Recipe 3.10. Detecting IDS Evasion
