C

H A P T E R

1

Introduction to 

Intrusion Detection 

and Snort

ecurity is a big issue for all networks in today's enterprise environ 

S

ment. Hackers and intruders have made many successful attempts to

bring down high profile company networks and web services. Many

methods have been developed to secure the network infrastructure and

communication over the Internet, among them the use of firewalls,

encryption, and virtual private networks. Intrusion detection is a relatively

new addition to such techniques. Intrusion detection methods started

appearing in the last few years. Using intrusion detection methods, you

can collect and use information from known types of attacks and find out

if someone is trying to attack your network or particular hosts. The infor 

mation collected this way can be used to harden your network security, as

well as for legal purposes. Both commercial and open source products are

now available for this purpose. Many vulnerability assessment tools are

also available in the market that can be used to assess different types of

security holes present in your network. A comprehensive security system

consists of multiple tools, including:

  Firewalls that are used to block unwanted incoming as well as outgo 

ing traffic of data. There is a range of firewall products available in

the market both in Open Source and commercial products. Most pop 

ular commercial firewall products are from Checkpoint (http://

www.checkpoint.com), Cisco (http://www.cisco.com) and Netscreen

1