Snort 2.1 Intrusion Detection, Second Edition and over 2 million other books are available for Amazon Kindle . Learn more

Trade in Yours
For a 0.25 Gift Card
Trade in
Have one to sell? Sell yours here
Sorry, this item is not available in
Image not available for
Image not available

Start reading Snort 2.1 Intrusion Detection, Second Edition on your Kindle in under a minute.

Don't have a Kindle? Get your Kindle here, or download a FREE Kindle Reading App.

Snort 2.1 Intrusion Detection, Second Edition (Jay Beale's Open Source Security) [Paperback]

Brian Caswell , Jay Beale

Available from these sellers.


Amazon Price New from Used from
Kindle Edition 26.36  
Paperback --  
Trade In this Item for up to 0.25
Trade in Snort 2.1 Intrusion Detection, Second Edition (Jay Beale's Open Source Security) for an Amazon Gift Card of up to 0.25, which you can then spend on millions of items across the site. Trade-in values may vary (terms apply). Learn more

Book Description

6 Jun 2004 1931836043 978-1931836043 2nd Revised edition
Called "the leader in the Snort IDS book arms race" by Richard Bejtlich, top Amazon reviewer, this brand-new edition of the best-selling Snort book covers all the latest features of a major upgrade to the product and includes a bonus DVD with Snort 2.1 and other utilities.

Written by the same lead engineers of the Snort Development team, this will be the first book available on the major upgrade from Snort 2 to Snort 2.1 (in this community, major upgrades are noted by .x and not by full number upgrades as in 2.0 to 3.0). Readers will be given invaluable insight into the code base of Snort, and in depth tutorials of complex installation, configuration, and troubleshooting scenarios. Snort has three primary uses: as a straight packet sniffer, a packet logger, or as a full-blown network intrusion detection system. It can perform protocol analysis, content searching/matching and can be used to detect a variety of attacks and probes. Snort uses a flexible rules language to describe traffic that it should collect or pass, a detection engine that utilizes a modular plug-in architecture, and a real-time alerting capability. A CD containing the latest version of Snort as well as other up-to-date Open Source security utilities will accompany the book.

Snort is a powerful Network Intrusion Detection System that can provide enterprise wide sensors to protect your computer assets from both internal and external attack.

* Completly updated and comprehensive coverage of snort 2.1
* Includes free CD with all the latest popular plug-ins
* Provides step-by-step instruction for installing, configuring and troubleshooting

Product details

More About the Author

Discover books, learn about writers, and more.

Product Description

About the Author

By Brian Caswell and Jay Beale

Inside This Book (Learn More)
First Sentence
It's three o'clock in the morning, and Andy Attacker is hard at work. Read the first page
Explore More
Browse Sample Pages
Front Cover | Copyright | Table of Contents | Excerpt | Index
Search inside this book:

What Other Items Do Customers Buy After Viewing This Item?

Customer Reviews

There are no customer reviews yet on
5 star
4 star
3 star
2 star
1 star
Most Helpful Customer Reviews on (beta) 4.4 out of 5 stars  11 reviews
52 of 54 people found the following review helpful
4.0 out of 5 stars Still the best Snort book, but not as good as it should be 12 July 2004
By Richard Bejtlich - Published on
Syngress published "Snort 2.0" in Mar 03, and I gave it a four star review in Jul 03. Excerpts from that review appear on the back cover and first page of "Snort 2.1," published only 14 months later. I still think "Snort 2.1" is overall the best Snort book available, but I was disappointed by signs of rushed production and lack of coverage of key Snort features.
The table of contents for "Snort 2.1" is deceiving, as it is almost exactly the same as "Snort 2.0." However, the new book is almost 200 pages larger than its predecessor, with many internal modifications. Chapters 1, 2, 3, 4, 9, 11, 12 and 13 are either completely new or substantially new. Chapters 5, 6, 7, 8, and 10 are either partial rewrites or have some material added or dropped. Despite all of this work, "Snort 2.1" fails to spend time on key subjects, which I will mention during a chapter-by-chapter examination of the book.
First, I recommend skipping ch 1. Aside from some general IDS advice, it is haphazard and contributes nothing to the core Snort discussion. Ch 2 is a quick overview of Snort capabilities, and should have been the lead chapter. Ch 3 describes Snort installation, but suffers apparently swapped figures (3.1 and 3.2) and a wrong figure (3.5). Ch 3 is still a nice upgrade from its counterpart in "Snort 2.0," which gave hints for deploying Snort on Red Hat Linux 8.0. The new ch 3 covers Linux, OpenBSD, and Windows.
Ch 4, "Inner Workings," is one of the reasons "Snort 2.1" has an advantage over the competition. It's tough to go wrong when Snort's developers describe the tool's operation. Still, signs of rough editing appear on p. 170 and 191, and the "-a cmg" switch should be "-A cmg".
Ch 5 covers rules, and is a big disappointment. For most users, rules are the primary means to customize Snort. Like "Snort 2.0," ch 5 fails to help readers with some of the more important new Snort rule options, like byte_test, byte_jump, distance, and within (available since 2.0.rc1 in Mar 03). Ch 5 implies on p. 145 that running Snort with -v is a good idea, despite every other recommendation in the book that verbose mode is a performance killer. Also, the IP "sec" option mentioned on p. 205 is not "IPSec" -- see RFC 791. Overall, ch 5 spends too much time restating rule information found in Snort's manual, and not enough time on features available even in Snort 2.0.
Ch 6's discussion of preprocessors is a solid chapter, with new material on Snort's flow module, http_inspect, and perfmonitor. The telnet preprocessor section is one of the better examples of a "code walkthrough," where the author shows code while explaining what it does.
Ch 7 is really showing its age. "Snort 2.0" was behind the times when it said "Unified logs are the future of Snort reporting," and "Snort 2.1" makes the same mistake. Barnyard, a means to read unified logs, was available in Sep 01! Ch 7 also misses the boat on XML output, calling it "our favorite and relatively new logging format" on p. 322. The XML plug-in spo_xml wasn't even part of snort-2.0.0, never mind snort-2.1.0. Basic research would have revealed Joe McAlerney's announcement of Silicon Defense's snort-idmef XML plug-in in Jun 01, followed by Sandro Poppi's assumption of the project in Aug 03. A mention of Barnyard's "XML formatting capabilities" appears in ch 7 on p. 322, yet Barnyard does not offer this natively.
I was happy to see Sguil addressed in ch 8, but sad to see Sguil's use of session and full content data not appreciated for its true worth. Ch 9 does a good job describing Oinkmaster and gives sound advice on avoiding the "not any" rule negation problem. Ch 10 covers really old testing tools like Sneeze, whose stateless operation cannot fool stream4's stateful inspection.
Ch 11, explaining Barnyard, is clearly the book's shining moment. This is the reason I read "Snort 2.1": Barnyard's author, Andrew Baker, describes Barnyard's history, the format of unified logs, and how best to use his contribution to Snort. Bravo. Ch 12 was also very good, using case studies to compare three different "active response" choices. Ch 13 was new but not exceptionally helpful.
I would enjoy seeing three improvements in the third edition. First, thoroughly scrub the book for old information. Watch out for people writing about "Cerebus" or http_decode or offerings from Silicon Defense, whose Web site disappeared in early 2004. Second, tell people to read the excellent Snort manual before reading the book. There's no need to address topics well-covered in the manual, like all of the IP- and TCP-based rule options. Third, ditch the existing rules chapter in favor of two new ones, one explaining principles via existing rules, and one showing advanced rule development.
I still recommend buying this book, but you might guide your reading choices by the comments in this review.
5 of 5 people found the following review helpful
5.0 out of 5 stars Detailed information for IDS systems and Snort in particular 15 July 2004
By Harold McFarland - Published on
If you want to know about Snort 2.1, one of the best open source intrusion detections systems available, then "Snort 2.1 Intrusion Detection, Second Edition" is the book you will want to have. This is an extensive examination of the Snort program and includes Snort 2.1 on CD with the Book.
The authors start with defining what an intrusion detection system is, what it is not, and how placing it in your network at different points achieves different goals. This is followed by an introduction to Snort and a description of its capabilities and functions before getting into the nuts and bolts of installing and configuring it.
One of the more difficult parts of Snort to understand is how to write the rules that determine when an intrusion has occurred. The authors do an excellent job of describing exactly how to write good rules to achieve the results you want. They even include an excellent section on how to deal with all that information you will be collecting.
"Snort 2.1 Intrusion Detection, Second Edition" is highly recommended for anyone who wants a good, useful explanation of how an intrusion detection system should work and how to implement Snort to achieve that result.
1 of 1 people found the following review helpful
5.0 out of 5 stars mighty impressive second edition 30 Jun 2004
By Seth James - Published on
I was concerned this book may fall into the "second edition trap" of search and replace 2.0 with 2.1. Upon thorough reading, this is obviously not the case. The authors have thoroughly documented all new/enhanced features of 2.1, but more importantly they again break new ground by by providing unique, creative, and thoroughly useful information on things like writing rules, the intricacises of preprocessors, etc. They don't just teach you how to USE snort, they teach you how to think about using Snort (and other tools) to better defend your network. The chapter on Barnyard in particular was very interesting, and it's obvious from following following the Snort site/list that a lot of the new features were develped in conjunction with the writing of this book. So, this book isn't a re-hash of information, it's the definitive work from the creators.
4.0 out of 5 stars Snort 2.1 23 Feb 2006
By Jon T. Mccombs - Published on
The information in this book was invalueable but sometimes it was hard to follow because it was poorly written
4.0 out of 5 stars Good introductionto Snort 28 Nov 2005
By Amazon Customer - Published on
Snort 2.1 Intrusion Detection (2nd Edition) is useful as a general introduction to intrusion detection and Snort. If you already have a good understanding of IDS technology you may find the IDS discussion to be a bit general in nature. For someone who only wants to review the basic IDS principals quickly and without a great deal of extra detail the IDS coverage in this book is sufficient. Much of the information on Snort felt like a retelling of Snort Users Manual from the Snort web site. Part of this feeling may be due to the fact that members of the Snort development team who undoubtedly had a hand in the user's manual wrote this book. This book does go into more detail on some subjects than the Snort Users Manual. There is a good step by step set of instructions for installing Snort and associated software on either a Windows or a Linux system. Overall this book seems to be a pretty good overview of Snort for someone looking to use only one resource, but I do not see anything that is not also available in other documentation available.
Were these reviews helpful?   Let us know

Customer Discussions

This product's forum
Discussion Replies Latest Post
No discussions yet

Ask questions, Share opinions, Gain insight
Start a new discussion
First post:
Prompts for sign-in

Search Customer Discussions
Search all Amazon discussions

Look for similar items by category