260

Index

fragbits 

keyword, 97

sample default rules, 127 128

icmp_id 

keyword, 98

structure of, 79 81

icmp_seq 

keyword, 98

TCP/IP network layers, 76 77

icode 

keyword, 99 100

uses of, 75 76

id 

keyword, 100

running in stealth mode, 71 72

ipopts 

keyword, 100 101

running on a non default interface, 51 52

ip_proto 

keyword, 101 102

running on multiple network interfaces, 

itype 

keyword, 98 99

53

logto 

keyword, 102 103

shutting down automatically, 52 53

msg 

keyword, 103

simplified block diagram for, 132

nocase 

keyword, 103

snort.conf

, 56

offset 

keyword, 94

starting, 29

priority keyboard, 103 104

automatically, 52 53

react word, 104

with database support, 171 172

reference 

keyword, 104 105

errors, 43

resp 

keyword, 105 107

starting with database support, 171 172

rev 

keyword, 107

on stealth interface, 20

rpc 

keyword, 107 108

stopping, 29

sameip 

keyword, 108

summary, 41 42

seq 

keyword, 108

testing, 43 51

session 

keyword, 109

web site, 24, 28, 73

sid 

keyword, 110

Snort alert modes, 66 71

tag 

keyword, 110 111

fast mode, 67 68

tos 

keyword, 111

full mode, 68

ttl 

keyword, 111

no alert mode, 69

uricontent 

keyword, 111

sending alerts to SNMP, 69

rules, 75 129

sending alerts to Syslog, 69

actions, 79, 81 83

sending alerts to Windows, 70 71

address, 80, 84 86

UNIX socket mode, 68

automatically updating, 120 125

Classless Inter Domain Routing (CI 

snort  ? 

command, 82

DR), 78 79, 84

Snort config directives, 114 15

default rules and classes, 125 127

alertfile, 114

direction, 80 81, 88

alert_with_interface_name, 114

extending, 75

bpf_file, 114

first bad rule, 77 78

checksum_mode, 115

local.rules file, 127

chroot, 115

order based upon action, 119 120

classification, 114

port number, 86 88

daemon, 114

ports, 80

decode_arp, 114

protocols, 80, 83 84

decode_data_link, 114

rating good rules, 128 129

dump_chars_only, 114

rule header, 79 81

dump_payload, 114

rule options, 79

dump_payload_verbose, 115