C

O N T E N T S

 Chapter 1   

Introduction to Intrusion Detection and Snort

1

1.1 What is Intrusion Detection?

5

1.1.1

Some Definitions

6

1.1.2

Where IDS Should be Placed in Network Topology

8

1.1.3

Honey Pots

9

1.1.4

Security Zones and Levels of Trust

10

1.2 IDS Policy

10

1.3 Components of Snort

12

1.3.1

Packet Decoder

13

1.3.2

Preprocessors

13

1.3.3

The Detection Engine

14

1.3.4

Logging and Alerting System

15

1.3.5

Output Modules 

15

1.4 Dealing with Switches

16

1.5 TCP Stream Follow Up 

18

1.6 Supported Platforms

18

1.7 How to Protect IDS Itself

19

1.7.1

Snort on Stealth Interface 

20

1.7.2

Snort with no IP Address Interface

20

1.8 References

21

vii