FREE Delivery in the UK.
Only 1 left in stock (more on the way).
Dispatched from and sold by Amazon.
Gift-wrap available.
Quantity:1
Intrusion Detection with ... has been added to your Basket
+ £2.80 UK delivery
Used: Good | Details
Condition: Used: Good
Comment: Ships from USA. Please allow 2 to 3 weeks for delivery. Book has a small amount of wear visible on the binding, cover, pages. A tradition of quality and service.
Trade in your item
Get a £0.40
Gift Card.
Have one to sell?
Flip to back Flip to front
Listen Playing... Paused   You're listening to a sample of the Audible audio edition.
Learn more
See this image

Intrusion Detection with SNORT: Advanced IDS Techniques Using SNORT, Apache, MySQL, PHP and ACID (Bruce Perens' Open Source) Paperback – 8 May 2003


See all formats and editions Hide other formats and editions
Amazon Price New from Used from
Paperback
"Please retry"
£27.99
£19.20 £1.76
£27.99 FREE Delivery in the UK. Only 1 left in stock (more on the way). Dispatched from and sold by Amazon. Gift-wrap available.

Special Offers and Product Promotions

  • Win a £5,000 Amazon.co.uk Gift Card for your child's school by voting for their favourite book. Learn more.
  • Prepare for the summer with our pick of the best selection for children (ages 0 - 12) across Amazon.co.uk.

Frequently Bought Together

Intrusion Detection with SNORT: Advanced IDS Techniques Using SNORT, Apache, MySQL, PHP and ACID (Bruce Perens' Open Source) + Managing Security with Snort & IDS Tools
Price For Both: £50.51

Buy the selected items together


Win a £5,000 Amazon.co.uk Gift Card and 30 Kindle E-readers for your child or pupil's school.
Vote for your child or pupil(s) favourite book(s) here to be in with a chance to win.

Product details


More About the Author

Discover books, learn about writers, and more.

Product Description

From the Back Cover

Protect your network with Snort: the high-performance, open source IDS

Snort gives network administrators an open source intrusion detection system that outperforms proprietary alternatives. Now, Rafeeq Ur Rehman explains and simplifies every aspect of deploying and managing Snort in your network. You'll discover how to monitor all your network traffic in real time; update Snort to reflect new security threats; automate and analyze Snort alerts; and more. Best of all, Rehman's custom scripts integrate Snort with Apache, MySQL, PHP, and ACID-so you can build and optimize a complete IDS solution more quickly than ever before.

  • An expert introduction to intrusion detection and the role of Snort
  • Writing and updating Snort rules to reflect the latest attacks and exploits
  • Contains detailed coverage of Snort plug-ins, preprocessors, and output modules
  • Logging alerts to a MySQL database
  • Using ACID to search, process, and analyze security alerts
  • Using SnortSnarf to analyze Snort log files
  • XML support for Snort via the Simple Network Markup Language (SNML)
FTP Site

The accompanying ftp site contains all the software, scripts, and rules you need to get started with Snort.

About the Open Source Series

Bruce Perens' Open Source Series is a definitive series of Linux and Open Source books by the world's leading Linux software developers. Bruce Perens is the primary author of The Open Source Definition, the formative document of the open source movement, and the former Debian GNU/Linux Project Leader. The text of this book is Open Source licensed

About the Author

RAFEEQ UR REHMAN is founding director of Argus Network Security Services, Inc. He is an HP Certified System Administrator and CCNA with more than nine years' experience in UNIX and network administration, as well as C and database programming. His books include The Linux Development Platform; Solaris 8 Training Guide (310-043): Network Administrator Certification; and HP Certified: HP-UX System Administration. He is a contributing writer for SysAdmin Journal and Linux Journal.


Inside This Book

(Learn More)
First Sentence
Security is a big issue for all networks in today's enterprise environment. Read the first page
Explore More
Concordance
Browse Sample Pages
Front Cover | Copyright | Table of Contents | Excerpt | Index | Back Cover
Search inside this book:

Customer Reviews

There are no customer reviews yet on Amazon.co.uk.
5 star
4 star
3 star
2 star
1 star

Most Helpful Customer Reviews on Amazon.com (beta)

Amazon.com: 9 reviews
17 of 20 people found the following review helpful
Weakest of the Snort books published thus far 16 July 2003
By Richard Bejtlich - Published on Amazon.com
Format: Paperback
"Intrusion Detection with Snort: Advanced IDS, etc." (IDWS) was the second of this year's intrusion detection books I've reviewed. The first was Tim Crothers' "Implementing Intrusion Detection Systems" (4 stars). I was disappointed by IDWS, since I have a high opinion of Prentice Hall and the new "Bruce Perens' Open Source Series." (I'm looking forward to the book on CIFS, for example.) IDWS read poorly and doesn't deliver as much useful content as the competing Syngress book "Snort 2.0."

The most difficult aspect of reading IDWS is the author's grammar, particularly his avoidance of using definitive articles like "the", and other important words. For instance, p. 3 says "Apache web server takes help from ACID, etc." p. 133 claims "However, if you are using HTTP decode preprocessor, this attempt can detected." Beyond grammar, the author demonstrates weak knowledge of the IDS field, stating on p. 1 "Intrusion detection methods starting appearing in the last few years." James Anderson led the way in 1980, followed by Denning and Neumann in 1983 and Todd Heberlein in 1990! The author also repeatedly compares IDS to anti-virus signatures, which is simplistic and incorrect.

Technical errors further hamper IDWS. p. 89 makes the mistake of saying TCP sequence numbers count packets; they really count bytes of application data. p. 96-97 confuses the use of standard Boolean operators (AND, OR, NOT) with their use in Snort, which is different. (SF+ means SYN and FIN and zero or more other flags, not SYN AND FIN alone.) The fuzzy diagrams don't appear professional, and acronyms like "PHP" are defined incorrectly as "Pretty Home Page" (rather than the self-referencing "PHP Hypertext Processor.")

Coverage of important topics is lacking or outdated. First, Snort 1.9 is the basis for the text. However, 2.0 is available and covered by the Syngress book. The output system Barnyard and unified logging receive a total of one page. No meaningful mention is made of the effects of collecting traffic via hub, SPAN port, or tap. The port list on pp. 87-88 shows "well known ports," but doesn't say if they are TCP or UDP. The author makes odd claims about Snort "not [being] able to analyze application layer protocols," which is misleading. Snort rules aren't designed specifically for HTTP, for example, but they can be used to inspect HTTP requests and responses.

My favorite part of IDWS was the coverage of using the MySQL database. Appendix B provides helpful supplemental material on this subject also. Bottom line: I would pass on IDWS but keep an eye on the other titles in the PHPTR "Open Source Series."
5 of 6 people found the following review helpful
Good IDS|Snort book 13 Aug. 2003
By Karel M Baloun - Published on Amazon.com
Format: Paperback
This book is an effective introduction to Intruder Detection, demonstrating how popular open-source tools can be used. I found the code samples, table, diagrams and screenshots to be clear and useful. I learned what I'd hoped to learn and feel empowered to set up an IDS myself. Plenty of links and resources when I want to learn more.
I read a few of the other reviews here after I read the book... especially Richard B's. I noticed some of the same techinical mistakes, but don't feel that they are a big deal. As a sr. software engineer and techinical editor, I always read critically, just mentally note them and continue. They aren't the kind of mistakes that make the code useless, or would confuse/mislead any level of reader. Another editing pass would help most books, and I none of the grammar mistakes annoy me - I read to learn what I can and move on, not to nitpick or get annoyed.
As far as 1.9 vs. 2.0, I've looked at the snort site and agree that the release is signficant, but it doesn't break backwards compatibility, so it doesn't make this book any less revelant. 2.0 seems to mostly change the backend implementation - *the application is used identically* so I suspect the vast majority of this book is unaffected. The Syngress book covers 2.0, yet so does the website, which hypes this two-times-more-expensive book. That book too will no doubt soon be superceded, so read whatever you buy immediately ;-)
12 of 16 people found the following review helpful
Not enough detail, and not up to date 27 May 2003
By Larry McGraw - Published on Amazon.com
Format: Paperback
This is the first book that I read on Snort, and I wish I had gone with something else. This book really reads like more of an overview of intrusion detection and Snort, rather than a useful reference for actually using Snort. This would be fine if the title did NOT include the words "Advanced" or "Techniques," because there is not a lot of either in this book. It also doesn't help that it's not written to the latest release. If you want to understand intrusion detection a little better and you are considering to try Snort, then this books is fine. If you want or need more, this just isn't the book.
Intro book. BAD use of Network Terminology. Don't be confused. 13 May 2013
By Varus - Published on Amazon.com
Format: Paperback
* It is an Intro Level book.
* References to Networking, Internetworking, and ICP/IP are bad and inaccurate.

I have only read the first three chapters, but I am writing a review nonetheless.
I will still continue to read this book, I still think it has information I can learn from.

Ya, this is worth mentioning. Someone trying to learn Snort, should not be hit with inaccurate and misleading usage of network terms.
For a reader, who is new to the IT world, who does not realize this author is being misleading in the use of networking terms and concepts (or perhaps the author simply does not know what he himself is talking about, which is not good), it can be confusing. The reader might even learn incorrect or inaccurate networking terms and concepts, which would not be good for the reader !!!

Leaning IT is challenging enough, especially for new people; INACCURACIES, misleading, or non-explicit use of terms, should NEVER be part of an IT document, paper, or book.

If YOU KNOW NOTHING OF --== Networking ==-- or --== Snort ==--, do not take everything in this book at 100% face value.
The references to Internetworking are bad. If you do not already know Internetworking and the related terminology and concepts, just know the Networking terms and concepts presented in this book are not accurate. I mean they can confuse you if you do not already know the subject matter.
For example, the TCP/IP protocol stack, or model, has ONLY FOUR Layers not Five. The Physical Layer is NOT part of the TCP/IP Architectural Model.

YES, this book's primary subject is "Snort," but references to other subjects, such as the references to networking, NEED to be accurate !!!

Just know the use of networking terms in this book is INACCURATE !!
It will confuse you if you do not already know the subject matter and realize the author's mistakes or lack of knowledge of the subject of networking.
Here are a couple easily accessed and ACCURATE references on networking concepts and terminology:
* [...]
* [...]

This author would FAIL an exam on Networking Fundamentals, or Internetworking Fundamentals. Bottom line, "" F "" for a grade.

Like the author's use of "point-to-point data communication" in reference to Layer 3 IP Networking.
That could be mistaken for, or confused with, the "point-to-point protocol" (PPP) which is an OSI LAYER 2 Protocol and has nothing to with OSI Layer 3 or even the IP Protocol.
The author should have used something like "Layer 3 to Layer 3," or "end-to-end," data communication between two nodes.
But AGAIN, since he is REFERENCING THE TCP/IP MODEL and not the Open System Interconnection (OSI) Model in his book, he is not evening referencing the correct Layer. Layer 3 of the OSI Model is Layer 2 of the TCP/IP Model.

He just uses terms that he should be more selective or explicit about.
Like the reference to "Ethernet breaking up an IP packet into smaller segments to satisfy the Ethernet 1500 byte Maximum Transmission Unit (MTU) limitation."
It should say something like:
"Ethernet breaking up an IP Datagram into smaller portions, or pieces, in order to satisfy the Ethernet Frame's 1500 byte Maximum Transmission Unit (MTU) limitation."

"Segment" should, as much as possible be limited to "TCP Segment" when discussing networking. He should say breaking it up into smaller portions, not segments. Ethernet does not use segments, EXCEPT for the ESTABLISHMENT of COLLISION DOMAINS. But CSMA/CD is an entirely different subject matter itself. Ethernet segments dealing with CSMA/CD is an OSI Model Layer 1 topic. There just needs to be better explicit use of terminology. Someone unfamiliar with networking might take the misuse of terms literally, or as being a factual statement.

For example, the paragraph above just referred to the term "Segment" in more than one way or concept. A new person who does not know what is being discussed would be confused if "Segment" were to be used time and time again in misleading or incorrect ways.... "What ...."

The term "Segment" or "Segments." in reference to Protocol Data Units (PDU) should be explicit to "TCP SEGMENTS" and the use of the term "segment," in a document that includes a discussion on networking that is above the Physical Layer, should be limited to TCP subject matter, as much as possible.
"Packet" is more associated with the OSI Reference Network Model. When talking explicitly about IP and the the TCP/IP network model, IP Datagram is the better term.
For a reader, who does not yet know "EXPLICIT network terminology and concepts" this author's misuse of terms might be an issue of confusion.

The author uses the term "Packet" too generically.
TCP "Segments," UDP "Datagrams," IP "Datagrams," Ethernet "Frames," ATM "Cells."
A "Datagram" is any connectionless Protocol Data Unit (PDU). Internet Protocol (IP) is connectionless.

Like MATH. If you are talking about WHOLE NUMBERS, you do not want to confuse them with NATURAL NUMBERS, or Qualities with Inequalities.
I mean if you were to read, or studied, a math book that confused, or misused, terms or concepts, you would TRASH it !!!!!

The Earth is FLAT, but if you look up at the night's sky, you can see a ROUND Moon. TRASH as far as science and technology goes.

The author just mismatches terms and words that he should not mismatch !!!

For a reader, who is new to the IT world, who does not realize this author is being misleading in the use of networking terms and concepts (or perhaps the author simply does not know what he himself is talking about, which is not good), it can be confusing. The reader might even learn incorrect or inaccurate networking terms and concepts, which would not be good for the reader !!!

Leaning IT is challenging enough, especially for new people; INACCURACIES, misleading, or non-explicit use of terms, should NEVER be part of an IT document, paper, or book.
Great Resource 18 Feb. 2013
By TechGeek - Published on Amazon.com
Format: Paperback Verified Purchase
This was very helpful in getting our Snort implementation into production. We have a more complicated setup, capturing packets on both the internal and external interfaces and this resource was invaluable in helping us get over that last hurdle.
Were these reviews helpful? Let us know


Feedback