One part of an overall information security initiative is the area of Intrusion Detection. The focus of this research paper is to educate the reader about the need for an intrusion detection capability. Specifically, I examine the role of network intrusion detection and how one open source tool, Snort, can be used to establish a defense against many attacks. Before I examine the specifics of Snort, I believe that it is important to quickly review the concepts of intrusion detection. Each type of intrusion detection system complements the other and both should be used in an effective information security program.
Host based systems allow administrators to effectively monitor back doors into systems.
Network intrusion detection system are effective in learning about and monitoring the various exploits that intruders can use. One open source network intrusion detection system is Snort. The detection engine is programmed using a simple language that describes per packet tests and actions. Ease of use simplifies and expedites the development of new exploit detection rules. Index Snort Command Line Summary and Usage Snort has an extensive set of features and command line options.