Index

261

interface, 114

snortdb extra 

script, 168

logdir, 114

/snortlog

, 57

nolog, 115

snortrules.tar.gz 

file, 121

no_promote, 115

SnortSam, 210 212

obfuscate, 115

SnortSnarf, 25, 177, 202 208, 207

order, 114

defined, 202

pkt_count, 115

main page, 204

quiet, 115

running from a cron script, 203

reference_net, 114

set_gid, 114

Snot, 156

set_uid, 115

Source address, 81

stateful, 115

Source Address field, IP packet header, 238

umask, 115

Source hardware address field, ARP packet 

utc, 115

header, 242

verbose, 115

Source port, 81

Snort data:

Source Port field, TCP packet header, 240

logging in binary format, 63 65

Source protocol address field, ARP packet 

logging in text format, 63

header, 242

Snort database:

South Florida honeypot project, 10

creating in MySQL, 161 163

Splay tree algorithm, 135 136

creating tables in, 164 170

src 

directory, 31

extra tables, creating, 167 168

maintenance, 175 176

stateful directive, 115

archiving, 175

stateless option, 

flow 

keyword, 109

dropping the database, 176

Statistical Packet Anomaly Detection Engine 

tools, 175

(SPADE), 137

sample entries in database tables, 168 

Stealth mode, running Snort in, 71 72

170

stream_only option, 

flow 

keyword, 109

schema, 176

Strict Source Routing (ssrr), 101

snort 

file, 29 30

Stunnel, 159, 174, 176

Snort network intrusion detection mode, 65 

Supported platforms, 18 19

66

Switches, 16 18

Snort network sniffer mode, 58 65

SYN scan method, 135

logging Snort data in text format, 63

Syslog module, 139

logging Snort in binary format, 63 65

alert_syslog 

output module, 140 142

snort test auto.sh

, 47 51

Syslog, sending alerts to, 69

snort test.sh

, 44 46

syslog.conf 

file, 142

Snort XML parsers, 146

snort_archive

, 181 182, 198

T

snort.conf

, 38 40, 54, 56, 57, 76, 118 120, 

tag 

keyword, 110 111

128, 131, 138 140, 153 154, 212

arguments used with, 110

modifying, 170 171

tar 

command, 30

preprocessor, general format of, 134

tar 

file, 56