This is basically a book about intrusion detection using all open source tools. It starts with an introductory chapter that explains the problem of defining an intrusion and why it is becoming more and more of a problem. It follows up with a chapter on network traffic analysis including packet sniffing and using tcpdump and ethereal. Then comes the meat of the text - installing Snort. Of course to really understand how to use Snort you have to understand how attacks occur and the common methods used.

http://www.online-tech.org/books/OReilly.Managing.Security.with.Snort.and.IDS.Tools.Aug.2004.eBook-DDU.chm

ShareThis