Facebook Twitter Pinterest
  • Alle Preisangaben inkl. MwSt.
Nur noch 1 auf Lager (mehr ist unterwegs).
Verkauf und Versand durch Amazon. Geschenkverpackung verfügbar.
Intrusion Detection with ... ist in Ihrem Einkaufwagen hinzugefügt worden
+ EUR 3,00 Versandkosten
Gebraucht: Sehr gut | Details
Zustand: Gebraucht: Sehr gut
Kommentar: Unbenutzt. Schnelle Lieferung, Kartonverpackung. Abzugsfähige Rechnung. Bei Mehrfachbestellung werden die Versandkosten anteilig erstattet.
Möchten Sie verkaufen?
Zur Rückseite klappen Zur Vorderseite klappen
Hörprobe Wird gespielt... Angehalten   Sie hören eine Hörprobe des Audible Hörbuch-Downloads.
Mehr erfahren
Alle 2 Bilder anzeigen

Intrusion Detection with Snort: Advanced Ids Techniques Using Snort, Apache, MySQL, PHP, and Acid (Bruce Perens' Open Source) (Englisch) Taschenbuch – Mai 2003

1.0 von 5 Sternen 1 Kundenrezension

Alle Formate und Ausgaben anzeigen Andere Formate und Ausgaben ausblenden
Neu ab Gebraucht ab
"Bitte wiederholen"
EUR 42,99
EUR 29,66 EUR 4,21
8 neu ab EUR 29,66 5 gebraucht ab EUR 4,21
click to open popover

Es wird kein Kindle Gerät benötigt. Laden Sie eine der kostenlosen Kindle Apps herunter und beginnen Sie, Kindle-Bücher auf Ihrem Smartphone, Tablet und Computer zu lesen.

  • Apple
  • Android
  • Windows Phone

Geben Sie Ihre Mobiltelefonnummer ein, um die kostenfreie App zu beziehen.

Jeder kann Kindle Bücher lesen — selbst ohne ein Kindle-Gerät — mit der KOSTENFREIEN Kindle App für Smartphones, Tablets und Computer.




Network security has become an important part of corporate IT strategy and safeguarding all the nooks and crannies of your network can be timely and expensive. This book provides information about how to use free Open Source tools to build and manage an Intrusion Detection System. Rehman provides detailed information about using SNORT as an IDS and using Apache, MySQL, PHP and ACID to analyze intrusion data. The book contains custom scripts, real-life examples for SNORT, and to-the-point information about installing SNORT IDS so readers can build and run their sophisticated intrusion detection systems.SNORT is your network's packet sniffer that monitors network traffic in real time, scrutinizing each packet closely to detect a dangerous payload or suspicious anomalies.NSS Group, a European network security testing organization, tested SNORT along with intrusion detection system (IDS) products from 15 major vendors including Cisco, Computer Associates, and Symantec. According to NSS, SNORT, which was the sole Open Source freeware product tested, clearly outperformed the proprietary products.Part of the Bruce Perens' Open Source Series


Protect your network with Snort: the high-performance, open source IDS

Snort gives network administrators an open source intrusion detection system that outperforms proprietary alternatives. Now, Rafeeq Ur Rehman explains and simplifies every aspect of deploying and managing Snort in your network. You'll discover how to monitor all your network traffic in real time; update Snort to reflect new security threats; automate and analyze Snort alerts; and more. Best of all, Rehman's custom scripts integrate Snort with Apache, MySQL, PHP, and ACID-so you can build and optimize a complete IDS solution more quickly than ever before.

  • An expert introduction to intrusion detection and the role of Snort
  • Writing and updating Snort rules to reflect the latest attacks and exploits
  • Contains detailed coverage of Snort plug-ins, preprocessors, and output modules
  • Logging alerts to a MySQL database
  • Using ACID to search, process, and analyze security alerts
  • Using SnortSnarf to analyze Snort log files
  • XML support for Snort via the Simple Network Markup Language (SNML)
FTP Site

The accompanying ftp site contains all the software, scripts, and rules you need to get started with Snort. About the Open Source Series

Bruce Perens' Open Source Series is a definitive series of Linux and Open Source books by the world's leading Linux software developers. Bruce Perens is the primary author of The Open Source Definition, the formative document of the open source movement, and the former Debian GNU/Linux Project Leader. The text of this book is Open Source licensed

Alle Produktbeschreibungen


1.0 von 5 Sternen
5 Sterne
4 Sterne
3 Sterne
2 Sterne
1 Stern
Siehe die Kundenrezension
Sagen Sie Ihre Meinung zu diesem Artikel


Format: Taschenbuch Verifizierter Kauf
If all you've heard of Snort so far is the name this book may have something to offer, if however you have already set up a basic Snort and are looking for some extra info regarding the inner works, functions, setup tricks etc. you'll not be finding any in this collection of installation and setup howtos. Essentially this book has nothing to offer except a superficial look at how rules are created, a basic installation of Snort and the accompanying readmes cover everything else this book attempts to cover. If you plan to use Sourcefire rules the rules section i n this book will at best be an academic lesson. The parts about Apache, MySQL, PHP and ACID integration are a plain joke. Basically tis one gets a hands off from me but maybe I've mised the good stuff too, I read this in under 5 hours :(
Kommentar Eine Person fand diese Informationen hilfreich. War diese Rezension für Sie hilfreich? Ja Nein Feedback senden...
Vielen Dank für Ihr Feedback.
Wir konnten Ihre Stimmabgabe leider nicht speichern. Bitte erneut versuchen
Missbrauch melden

Die hilfreichsten Kundenrezensionen auf Amazon.com (beta)

Amazon.com: HASH(0x9649f6cc) von 5 Sternen 9 Rezensionen
17 von 20 Kunden fanden die folgende Rezension hilfreich
HASH(0x95ddc3cc) von 5 Sternen Weakest of the Snort books published thus far 16. Juli 2003
Von Richard Bejtlich - Veröffentlicht auf Amazon.com
Format: Taschenbuch
"Intrusion Detection with Snort: Advanced IDS, etc." (IDWS) was the second of this year's intrusion detection books I've reviewed. The first was Tim Crothers' "Implementing Intrusion Detection Systems" (4 stars). I was disappointed by IDWS, since I have a high opinion of Prentice Hall and the new "Bruce Perens' Open Source Series." (I'm looking forward to the book on CIFS, for example.) IDWS read poorly and doesn't deliver as much useful content as the competing Syngress book "Snort 2.0."

The most difficult aspect of reading IDWS is the author's grammar, particularly his avoidance of using definitive articles like "the", and other important words. For instance, p. 3 says "Apache web server takes help from ACID, etc." p. 133 claims "However, if you are using HTTP decode preprocessor, this attempt can detected." Beyond grammar, the author demonstrates weak knowledge of the IDS field, stating on p. 1 "Intrusion detection methods starting appearing in the last few years." James Anderson led the way in 1980, followed by Denning and Neumann in 1983 and Todd Heberlein in 1990! The author also repeatedly compares IDS to anti-virus signatures, which is simplistic and incorrect.

Technical errors further hamper IDWS. p. 89 makes the mistake of saying TCP sequence numbers count packets; they really count bytes of application data. p. 96-97 confuses the use of standard Boolean operators (AND, OR, NOT) with their use in Snort, which is different. (SF+ means SYN and FIN and zero or more other flags, not SYN AND FIN alone.) The fuzzy diagrams don't appear professional, and acronyms like "PHP" are defined incorrectly as "Pretty Home Page" (rather than the self-referencing "PHP Hypertext Processor.")

Coverage of important topics is lacking or outdated. First, Snort 1.9 is the basis for the text. However, 2.0 is available and covered by the Syngress book. The output system Barnyard and unified logging receive a total of one page. No meaningful mention is made of the effects of collecting traffic via hub, SPAN port, or tap. The port list on pp. 87-88 shows "well known ports," but doesn't say if they are TCP or UDP. The author makes odd claims about Snort "not [being] able to analyze application layer protocols," which is misleading. Snort rules aren't designed specifically for HTTP, for example, but they can be used to inspect HTTP requests and responses.

My favorite part of IDWS was the coverage of using the MySQL database. Appendix B provides helpful supplemental material on this subject also. Bottom line: I would pass on IDWS but keep an eye on the other titles in the PHPTR "Open Source Series."
5 von 6 Kunden fanden die folgende Rezension hilfreich
HASH(0x95de2984) von 5 Sternen Good IDS|Snort book 13. August 2003
Von Karel M Baloun - Veröffentlicht auf Amazon.com
Format: Taschenbuch
This book is an effective introduction to Intruder Detection, demonstrating how popular open-source tools can be used. I found the code samples, table, diagrams and screenshots to be clear and useful. I learned what I'd hoped to learn and feel empowered to set up an IDS myself. Plenty of links and resources when I want to learn more.
I read a few of the other reviews here after I read the book... especially Richard B's. I noticed some of the same techinical mistakes, but don't feel that they are a big deal. As a sr. software engineer and techinical editor, I always read critically, just mentally note them and continue. They aren't the kind of mistakes that make the code useless, or would confuse/mislead any level of reader. Another editing pass would help most books, and I none of the grammar mistakes annoy me - I read to learn what I can and move on, not to nitpick or get annoyed.
As far as 1.9 vs. 2.0, I've looked at the snort site and agree that the release is signficant, but it doesn't break backwards compatibility, so it doesn't make this book any less revelant. 2.0 seems to mostly change the backend implementation - *the application is used identically* so I suspect the vast majority of this book is unaffected. The Syngress book covers 2.0, yet so does the website, which hypes this two-times-more-expensive book. That book too will no doubt soon be superceded, so read whatever you buy immediately ;-)
12 von 16 Kunden fanden die folgende Rezension hilfreich
HASH(0x95ddcf30) von 5 Sternen Not enough detail, and not up to date 27. Mai 2003
Von Larry McGraw - Veröffentlicht auf Amazon.com
Format: Taschenbuch
This is the first book that I read on Snort, and I wish I had gone with something else. This book really reads like more of an overview of intrusion detection and Snort, rather than a useful reference for actually using Snort. This would be fine if the title did NOT include the words "Advanced" or "Techniques," because there is not a lot of either in this book. It also doesn't help that it's not written to the latest release. If you want to understand intrusion detection a little better and you are considering to try Snort, then this books is fine. If you want or need more, this just isn't the book.
HASH(0x95de3b58) von 5 Sternen Intro book. BAD use of Network Terminology. Don't be confused. 13. Mai 2013
Von Joseph R. - Veröffentlicht auf Amazon.com
Format: Taschenbuch
* It is an Intro Level book.
* References to Networking, Internetworking, and ICP/IP are bad and inaccurate.

I have only read the first three chapters, but I am writing a review nonetheless.
I will still continue to read this book, I still think it has information I can learn from.

Ya, this is worth mentioning. Someone trying to learn Snort, should not be hit with inaccurate and misleading usage of network terms.
For a reader, who is new to the IT world, who does not realize this author is being misleading in the use of networking terms and concepts (or perhaps the author simply does not know what he himself is talking about, which is not good), it can be confusing. The reader might even learn incorrect or inaccurate networking terms and concepts, which would not be good for the reader !!!

Leaning IT is challenging enough, especially for new people; INACCURACIES, misleading, or non-explicit use of terms, should NEVER be part of an IT document, paper, or book.

If YOU KNOW NOTHING OF --== Networking ==-- or --== Snort ==--, do not take everything in this book at 100% face value.
The references to Internetworking are bad. If you do not already know Internetworking and the related terminology and concepts, just know the Networking terms and concepts presented in this book are not accurate. I mean they can confuse you if you do not already know the subject matter.
For example, the TCP/IP protocol stack, or model, has ONLY FOUR Layers not Five. The Physical Layer is NOT part of the TCP/IP Architectural Model.

YES, this book's primary subject is "Snort," but references to other subjects, such as the references to networking, NEED to be accurate !!!

Just know the use of networking terms in this book is INACCURATE !!
It will confuse you if you do not already know the subject matter and realize the author's mistakes or lack of knowledge of the subject of networking.
Here are a couple easily accessed and ACCURATE references on networking concepts and terminology:
* [...]
* [...]

This author would FAIL an exam on Networking Fundamentals, or Internetworking Fundamentals. Bottom line, "" F "" for a grade.

Like the author's use of "point-to-point data communication" in reference to Layer 3 IP Networking.
That could be mistaken for, or confused with, the "point-to-point protocol" (PPP) which is an OSI LAYER 2 Protocol and has nothing to with OSI Layer 3 or even the IP Protocol.
The author should have used something like "Layer 3 to Layer 3," or "end-to-end," data communication between two nodes.
But AGAIN, since he is REFERENCING THE TCP/IP MODEL and not the Open System Interconnection (OSI) Model in his book, he is not evening referencing the correct Layer. Layer 3 of the OSI Model is Layer 2 of the TCP/IP Model.

He just uses terms that he should be more selective or explicit about.
Like the reference to "Ethernet breaking up an IP packet into smaller segments to satisfy the Ethernet 1500 byte Maximum Transmission Unit (MTU) limitation."
It should say something like:
"Ethernet breaking up an IP Datagram into smaller portions, or pieces, in order to satisfy the Ethernet Frame's 1500 byte Maximum Transmission Unit (MTU) limitation."

"Segment" should, as much as possible be limited to "TCP Segment" when discussing networking. He should say breaking it up into smaller portions, not segments. Ethernet does not use segments, EXCEPT for the ESTABLISHMENT of COLLISION DOMAINS. But CSMA/CD is an entirely different subject matter itself. Ethernet segments dealing with CSMA/CD is an OSI Model Layer 1 topic. There just needs to be better explicit use of terminology. Someone unfamiliar with networking might take the misuse of terms literally, or as being a factual statement.

For example, the paragraph above just referred to the term "Segment" in more than one way or concept. A new person who does not know what is being discussed would be confused if "Segment" were to be used time and time again in misleading or incorrect ways.... "What ...."

The term "Segment" or "Segments." in reference to Protocol Data Units (PDU) should be explicit to "TCP SEGMENTS" and the use of the term "segment," in a document that includes a discussion on networking that is above the Physical Layer, should be limited to TCP subject matter, as much as possible.
"Packet" is more associated with the OSI Reference Network Model. When talking explicitly about IP and the the TCP/IP network model, IP Datagram is the better term.
For a reader, who does not yet know "EXPLICIT network terminology and concepts" this author's misuse of terms might be an issue of confusion.

The author uses the term "Packet" too generically.
TCP "Segments," UDP "Datagrams," IP "Datagrams," Ethernet "Frames," ATM "Cells."
A "Datagram" is any connectionless Protocol Data Unit (PDU). Internet Protocol (IP) is connectionless.

Like MATH. If you are talking about WHOLE NUMBERS, you do not want to confuse them with NATURAL NUMBERS, or Qualities with Inequalities.
I mean if you were to read, or studied, a math book that confused, or misused, terms or concepts, you would TRASH it !!!!!

The Earth is FLAT, but if you look up at the night's sky, you can see a ROUND Moon. TRASH as far as science and technology goes.

The author just mismatches terms and words that he should not mismatch !!!

For a reader, who is new to the IT world, who does not realize this author is being misleading in the use of networking terms and concepts (or perhaps the author simply does not know what he himself is talking about, which is not good), it can be confusing. The reader might even learn incorrect or inaccurate networking terms and concepts, which would not be good for the reader !!!

Leaning IT is challenging enough, especially for new people; INACCURACIES, misleading, or non-explicit use of terms, should NEVER be part of an IT document, paper, or book.
9 von 14 Kunden fanden die folgende Rezension hilfreich
HASH(0x95de3d08) von 5 Sternen Just OK 23. Mai 2003
Von Ein Kunde - Veröffentlicht auf Amazon.com
Format: Taschenbuch
I got this book and read through it (didn't take me long. It's pretty short and actually has less than 200 pages really covering Snort). I was disappointed that it did not come with a CD with all the software. Also, this book covers Snort 1.9.0, but 2.0 just came out. I'm not sure why they didn't update everything to the latest version, which would have made it much more usefel. I guess it's not bad if you really just want a quick introduction to IDSs and Snort, but look elsewhere if you really want an in depth book on Snort.
Waren diese Rezensionen hilfreich? Wir wollen von Ihnen hören.

Ähnliche Artikel finden