Principles of Computer Security: CompTIA Security+ and Beyond Lab Manual (Exam SY0-601)

Chapter 13

Intrusion Detection Systems and Network Security

Lab Exercises

13.01   Installing Ubuntu and Snort

13.02   Snort Sniffer Mode

13.03   Snort Packet Logger Mode

13.04   Snort Network Intrusion Detection System Mode

Lab Analysis

Key Term Quiz

After stateless packet filter firewalls such as access control lists (ACLs) weed out undesirable traffic going into a network, there will still be malicious packets inside the network. Two issues are at work here. The first is that firewalls are just a single part of a more complex defense-in-depth architecture. Malicious packets can, and will, regularly evade firewalls. The second issue is that malicious traffic originating from inside the network is never checked by a network-based firewall, ...