252

Index

Analysis Control for Intrusion Database (AC 

Berkeley Packet Filter (BPF), 155

ID), 2 4, 21, 24, 90, 105, 157, 173, 177

Book website, 27

alert details, 191 192

BPF, 155

archiving Snort data, 198 200

bpf_file directive, 114

configuring, 181 184

Bugtraq, 104

DB Setup page, 184, 186

defined, 177 179

C

downloading, 179 180

Ca parameter, XML module, 146

features, 178

 c command line option, 55

first use of, 184 185

 C command line option, 114

graphs, generating, 198

Cert parameter, XML module, 146

installing, 179 181

Checkpoint, 1, 21

main page, 184, 188 189

Checkpoint Firewall 1, 210 211

protocol data, listing, 189 190

searching, 192 196

Checksum field, TCP packet header, 241

tables, 184, 187, 201 202

checksum_mode directive, 115

using, 184 202

chroot directive, 115

web site, 207

Cisco PIX, 210

whois databases, searching, 197

Cisco Systems, 1, 16, 21

Anomaly based intrusion detection, 5

classification directive, 114

 A none 

command line option, 69

classification.config

, 38 39, 56, 57, 90, 115

any 

keyword, 113

Classless Inter Domain Routing (CIDR), 78 

Apache Web server, 2, 21, 24, 26, 73, 177

79, 84, 129, 156

web site, 207

classtype 

keyword, 89 93

Application layer headers, 15

clientonly argument, to stream4_reassembly 

and signatures, 7

preprocessor, 137

Arachnids web site, 129

Command line options, Snort, 55 56

Argus Network Security Services Inc., 73

Common Internet File System (CIFS), 70

ARP packet header, 241 242

Computer Associates, 25

Attack signatures, 11

Configuration parameters, and 

snort.conf

, 

112

Attacks, 11

configure 

script, 31, 56

 a unsock 

command line option, 68

command line options, 31 33

Automatic update of Snort rules, 120 125

command line parameters, 35

simple message, 120 121

options, 34 35

sophisticated and complex method, 122 

output, 34

125

prefix 

option, 34

B

typical session with, 34

Barnyard, 7, 23, 154, 156

Console, logging data to, 66

defined, 207

content 

keyword, 93 94

installing, 207

content list 

keyword, 95

 b command line option, 55

Content matching, 94