Introduction to Intrusion Detection With Snort

Overview

As soon as someone discovers a new computer security vulnerability, hordes of crackers start knocking at the doors of computers worldwide to see if they can penetrate their defenses. Many sites employ a combination of border router firewalls and host-based packet filters and wrappers to protect themselves, but what if the vulnerability is in the very mechanism that's used to secure a service? How can systems administrators know that their machines are under attack and/or have been compromised? The best way to catch the crackers in the act is to use an Intrusion Detection System (IDS). After a brief discussion of IDS, this paper focuses on a pattern-matching network-based IDS, Snort.