Linux Server Security, Second Edition

This is the Title of the Book, eMatter Edition

Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.

472

|

Chapter 13: Simple Intrusion Detection Techniques

Snort

Integrity checkers are more like security camera tapes than burglar alarms. They

aren’t nearly as useful during an attack as they are afterward; usually by the time the

bad guys start changing files on a system, the attack has succeeded. This is because

integrity checking is limited to the local system: it involves local files, not network

packets. For more proactive intrusion detection (“intrusion in progress” or

“attempted intrusion” detection), we need to monitor attempted and pending

attacks while they’re still on the wire—before they make landfall on our systems.

The undisputed champion open source NIDS is Snort. Snort is a marvelous, versatile

thing. First, as a packet sniffer (or, if you prefer the more formal term, “protocol ana-

lyzer”), Snort is to tcpdump what Homo sapiens is to Homo habilis: same basic

genetic material, better brain. As a packet sniffer, Snort is extraordinarily fast, thor-

ough, and user friendly (or at least geek friendly).

Second, Snort is a packet logger. Snort can preserve complete audit trails of network

traffic, trails that name names and encase evidence in (figurative) acrylic blocks.

Third, Snort is a 100% customizable Network Intrusion Detection System with both

a library of contributed ...