262

Index

Target hardware address field, ARP packet 

generating with automatic Snort 47 

header, 242

51, 24 53

Target protocol address field, ARP packet 

test installation, 24

header, 242

Time Stamps (ts), 100

 t command line option, 115

timeout argument, stream4module, 136

 T command line option, 55, 114

/tmp 

directory, 50

TCP (*Transmission Control Protocol), 76

/tmp/rules 

directory, 121, 122

TCP connect port scanning, 135

to_client option, 

flow 

keyword, 109 110

TCP FIN packet, 104

TOS field, IP packet header, 238

TCP packet header, 240 241

tos 

keyword, 111

TCP packet, typical output for, 59

to_server option, 

flow 

keyword, 109 110

TCP stream follow up, 18

Total Length field, IP packet header, 238

tcpdump, 58, 221 222

Transport layer header, and signatures, 7

defined, 221

Trust, levels of, 10

log_tcpdump output module, 144 145

TTL field, IP packet header, 238

using to read Snort generated files, 64 65

ttl 

keyword, 111

telnet.rules 

files, 127

type argument, 

tag 

keyword, 110

$TELNET_SERVERS variable, 127

templates 

directory, 31

U

Test alerts:

 u command line option, 115

generating, 44 47

 U command line option, 115

with automatic Snort startup, 47 51

UDP packet header, 241

Testing Snort, 43 51

UDP packets, 111

multiple Snort sensors with centralized 

UDP (User Datagram Protocol), 76, 129

database, 26 28

umask directive, 115

from RPM package, 28 29

Unicode, 13

single center production IDS, 24 25

Unified logging output module, 153 154

single sensor:

with network management system 

Uniform Resource Identifier (URI), 13

integration, 25

UNIX socket mode, 68

with the database and Web interface, 

UNIX system, 82

25 26

UPDATE command, 163

from source code, 29 42

update_files 

keyword, 125

compilation and installation process, 

Upper and lower boundaries, port numbers, 87

31 37

Urgent Pointer field, TCP packet header, 241

procedures following installation 

processes, 37 42

uricontent 

keyword, 111

step by step procedure, 56

User parameter, databases used with Snort, 

unpacking, 30 31

151

test alerts:

/usr/lib/mysql 

directory, 161

generating, 44 47

utc directive, 115