HOW TO USE SNORT: FEATURES AND CAPABILITIES
Here we will discuss Snort basics and how
to use the intrusion detection tool. We will also cover Snort features, including their
limitations and capabilities, as well as tips on Snort Stream5, output options and overlapping
fragment detection.
Snort limitations and capabilities
(see link below)
Snort has a vast array of both benefits and drawbacks. Running the network inspection and control
system in active and passive mode, for example, has security implications.
In this tip, Richard Bejtlich discusses how to use Snort while
keeping the restrictions of the intrusion detection tool in mind.
Snort's Stream5 and TCP overlapping fragments
(see link below)
Stream5 is a critical aspect of the Snort IDS's inspection and detection equation. It performs
based on its specific configuration and thus must be configured correctly.
Here you will learn how Snort detects security events and how Snort
Stream5 preprocessor addresses several aspects of network-centric traffic inspection. Security
expert Richard Bejtlich also discusses Snort installation best practices, Snort testing best
practices and overlapping fragment detection.
Understanding Snort's Unified2 output
(see link below)
Unified output allows Snort to write sets of data to a sensor's hard drive. Writing to the hard
drive, instead of performing database inserts, allows Snort to operate faster and minimize packet
loss.
In this edition of the Snort Report, learn how using Snort's source code can help solution
providers understand Snort's
Unified2 output.
Output options for Snort data
(see link below)
Output modes are the methods by which Snort reports its findings when run in IDS mode. Without
output options, VARs cannot produce Snort data in a meaningful manner.
In this tip, intrusion detection expert Richard Bejtlich discusses output options
for Snort data and the pros and cons of different features.
When Snort is not enough: Using tools and techniques to support Snort
(see link below
Sometimes Snort is not enough to complete a detection and response operation, making the use of
other data-collecting tools and tactics essential.
Learn when and how to support Snort with
the use of complementary products and techniques.
Justifying Snort: Communicating the value of Snort
(see link below)
As a value-added reseller (VAR) or security service provider, there's no doubt that you believe
Snort and similar tools are valuable. Plenty of IT professionals, however, do not necessarily see
intrusion detection systems like Snort as invaluable to their customers and networks.
In this tip, you will learn how to communicate the value of Snort's
capabilities to those customers whose IT departments are resistant to the open source tool.
Channel Strategies for the CIO
Intrusion
detection systems (IDS) act as a protective barrier for network systems and data, gathering and
analyzing information on a network, as well as system and user activities, to detect potential
attacks and security breaches from both inside and outside the organization. Without a solid IDS
system in place, organizations increase their likelihood of falling victim to cybercrime attacks
and embarrassing, and often expensive, data security breaches.
How to
use Snort: Features and capabilities