Scribd Logo
Upload

Welcome to Scribd!

  • Linux Networking and Troubleshooting: IDS Explained

    Uploaded by

    eusphorus
    18 views5 pages
    Snort is an open source network intrusion prevention and detection system that performs real-time traffic analysis and packet logging. It can detect attacks like buffer overflows, port scans, and OS fingerprinting attempts. Snort includes a rule engine, output parser, and web interface. It works by monitoring traffic from a tap or span port between private networks and the open internet to detect vulnerabilities.

    Original Description:

    Original Title

    IDS Explained

    Copyright

    © © All Rights Reserved

    Available Formats

    PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    Report this Document
    Snort is an open source network intrusion prevention and detection system that performs real-time traffic analysis and packet logging. It can detect attacks like buffer overflows, port scans, and OS fingerprinting attempts. Snort includes a rule engine, output parser, and web interface. It works by monitoring traffic from a tap or span port between private networks and the open internet to detect vulnerabilities.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Flag for inappropriate content
    Download as pdf or txt
    18 views5 pages

    Linux Networking and Troubleshooting: IDS Explained

    Uploaded by

    eusphorus
    Snort is an open source network intrusion prevention and detection system that performs real-time traffic analysis and packet logging. It can detect attacks like buffer overflows, port scans, and OS fingerprinting attempts. Snort includes a rule engine, output parser, and web interface. It works by monitoring traffic from a tap or span port between private networks and the open internet to detect vulnerabilities.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Flag for inappropriate content
    Download as pdf or txt
    of 5

    Linux Networking and

    Troubleshooting
    IDS Explained

    Linux Networking and Troubleshooting


    IDS :: DEFINITION

    Intrusion Detection System


    Network security component for detecting vulnerability exploits against a system or infrastructure.

    Intrusion Prevention System


    Network security component for preventing vulnerability exploits against a system or infrastructure.

    Linux Networking and Troubleshooting


    IDS :: ARCHITECTURE
    Open
    Internet

    PRIVATE NETWORK Tap/Span

    IDS
    Misc. Hosts

    Linux Networking and Troubleshooting


    IDS :: SNORT

    Snort is an open source network intrusion prevention system, capable of performing real-time
    traffic analysis and packet logging on IP networks. It can perform protocol analysis, content
    searching/matching, and can be used to detect a variety of attacks and probes, such as buffer
    overflows, stealth port scans, CGI attacks, SMB probes, OS fingerprinting attempts, and much
    more. -- Snort FAQ

    Snort is an open source IPS/IDS maintained by Cisco


    Increasing overlap between proprietary and open source offerings

    Can be used as a packet sniffer, packet logger, or an IPS

    Linux Networking and Troubleshooting


    IDS :: SNORT ARCHITECTURE

    Rule Engine
    1 SNORT Running as a service/daemon
    Frequent rule updates

    Example
    IDS/IPS 2 BARNYARD2 Binary Snort output parser
    Infrastructure

    GUI
    3 SNORBY
    Web interface for implementation

    Linux Networking and Troubleshooting

    You might also like