254

Index

from_client option, 

flow 

keyword, 109 110

ICMP redirect packet, 100

from_server option, 

flow 

keyword, 109 110

icmp_id 

keyword, 98

FTP header, 15

icmp_seq 

keyword, 98

Full mode, 68

icode 

keyword, 99 100

G

 i command line option, 55, 114

 g command line option, 114

 I command line option, 55

GD library, 

See

 Graphic display library 

ID field, IP packet header, 238

(GD library):

id 

keyword, 100

GET 

keyword, 93

IDS policy, 10 11

Glossary, 243 244:

IDS policy manager, 212 217

Graphic display library (GD library), 3 4, 24, 

adding a new sensor to, 214 215

180, 207

modifying a rule in, 216

Policy Editor window, 215 217

H

window, 213

Hackers, 1, 8, 9, 11, 13 14, 134

IHL field, IP packet header, 238

Header Checksum field, IP packet header, 238

include files, and 

snort.conf

, 112

Hewlett Packard, 25

include 

keyword, 112, 117

HIDS, 6

Input modules, 133

HOME_NET, 112 113

Input plug ins, 13 14, 133

Honey Pot project web site, 10, 21

INSERT command, 163

Honey pots, 9 10, 75

interface directive, 114

Honeyd web site, 10, 21

Internet Control Message Protocol (ICMP), 

Host based intrusion detection system 

156, 76, 80

fn

, 129

(HIDS), 6

Internet Corporation for Assigned Names and 

Host parameter:

Numbers (ICANN), 88, 102, 129

databases used with Snort, 151

Internet Protocol (IP), 9

XML module, 146

Intruders, 1, 178 179

HP OpenView, 11, 23, 69, 83

Intrusion detection, defined, 5 8

HW Addr Len field, ARP packet header, 242

Intrusion detection systems (IDS), 2, 6

HW Address Type field, ARP packet header, 

administration of, 11

242

documentation, 11

Hyper Text Transfer Protocol (HTTP) server, 

escalation process, 11

9, 86

FAQ, 21

HTTP decode, 133 134

incident handling, 11

I

monitoring, 11

placing in network typology, 8 9

 i eth0 

command line option, 72

policy, 10 11

IBM, 25

protecting, 19 21

ICMP packet header, 238 239

reporting, 11

ICMP packets, 78

signature updates, 11

ICMP ping packet, 80

typical locations for, 8