258

Index

Protocol Address Type field, ARP packet 

Rules:

header, 242

using variables in, 112 113

Protocol field, IP packet header, 238

using a list of networks in variables, 

Protocol parameter, XML module, 146

113

using interface names and variables, 

Q

113

 q command line option, 115

using the 

any 

keyword, 113

quiet directive, 115

Rules configuration, and 

snort.conf

, 112

R

rules 

directory, 31

react word, 104

ruletype 

keyword, 83

Record Route (rr), 100

Rusty's Unreliable Guides, 218 219

RedHat Linux, 24, 27, 29, 70, 142, 161, 223

S

reference 

keyword, 104 105

 s option, 140

reference.config

, 38 39, 56, 57, 105, 128

SAMBA, 70 71, 73, 143

reference_net directive, 114

sameip 

keyword, 108

Reserved Bit (RB), 97

Sample default rules, 127 128

Reserved field, TCP packet header, 240

checking for incorrect login on Telnet 

resp 

keyword, 105 107

sessions, 128

checking su attempts from a Telnet ses 

rev 

keyword, 107

sion, 127 128

RFC 768, 76, 166

SCP utility, 26

RFC 791, 68, 73, 81, 84, 97, 101, 111, 129, 

Secure Shell (SSH) protocol, 26

136, 156

Security, 1

RFC 792, 67, 73, 98, 99

Security zones, 10

RFC 793, 76, 96, 156, 166

Securityfocus mailing list archive, 129

RFC 1519, 84

SELECT command, 163

RFC 1700, 88, 102, 129

Sending alerts:

rpc 

keyword, 107 108

to SNMP, 69

RPM package, 42, 52, 57, 65

fn

to Syslog, 69

testing Snort from, 28 29

to Windows, 70 71

.rule

, 117 118

Sensor_name parameter, databases used with 

Rule actions, 81 83

Snort, 151

activate action, 82

Sensors, 8

alert action, 82

seq 

keyword, 108

dynamic action, 82

Sequence Number field, TCP packet header, 

log action, 82

240

user defined actions, 82 83

Server Message Block (SMB), 16, 70

Rule based intrusion detection, 5

Server parameter, XML module, 146

Rule files, 57

serveronly argument, to stream4_reassembly 

Rule headers, 81 83

preprocessor, 137

RULE_PATH variable, 38

session 

keyword, 109