snort 2 1 intrusion detection second edition phần 5 pot

snort 2.1 intrusion detection second edition phần 5 pot

... http://www.simpopdf.com 29 5 _Snort2 e_06.qxd 5/ 6/04 12 : 51 PM Page 310 Simpo PDF Merge and Split Unregistered Version - http://www.simpopdf.com 29 5 _Snort2 e_06.qxd 5/ 6/04 12 : 51 PM Page 28 1 Preprocessors • Chapter 6 28 1 ... Unregistered Version - http://www.simpopdf.com 29 5 _Snort2 e_06.qxd 5/ 6/04 12 : 51 PM Page 28 2 28 2 Chapter 6 • Preprocessors IAC SB SING HUMPTY-DUMPTY SE 25 5 25 0 53 1 24 0 There’s more to Telnet than this, ... http://www.simpopdf.com 29 5 _Snort2 e_06.qxd 5/ 6/04 12 : 51 PM Page 29 3Preprocessors • Chapter 6 29 3 int num = 0; if(portlist == NULL || *portlist == '\0') { portlist = " ; 21 23 25 11 9";...

76

343

0

snort 2.1 intrusion detection second edition phần 3 potx

... http://www.simpopdf.com 29 5 _Snort2 e_03.qxd 5/ 5/04 2: 55 PM Page 15 1Installing Snort • Chapter 3 15 1 localhost: tcp 58 7 tcp 25 0.0.0.0 tcp 22 tcp 37 tcp 13 tcp 11 3 OINK! For more information ... be 1 92. 16 8.0.0 /24 , which means that the address space of 1 92. 16 8.0. 1 92. 16 8.0 . 25 4 will be repre-sented, using a subnet mask of 25 5 . 25 5 . 25 5. 0 (see Figure 3 .14 ). Figure 3 .14 Editing the snort. conf ... 29 5 _Snort2 e_03.qxd 5/ 5/04 2: 55 PM Page 15 5 Installing Snort • Chapter 3 15 5 ===> Installing snort- 2. 0.0p1 from /usr/ports/packages/i386/all /snort- 2. 0.0p1.tgz Adding /usr/ports/packages/i386/all /snort- 2. 0.0p1.tgz...

76

432

0

snort 2.1 intrusion detection second edition phần 4 potx

... Be Merged 10 .1. 0.0 /22 10 .1. 0.0 /24 , 10 .1 .2. 0 /24 , 10 .1. 4.0 /24 , 10 .1. 6.0 /24 19 8.0.0.0 /20 19 8 .1. 0.0 / 21 , 19 8 .2. 0.0 / 21 10 .10 0.80.0/ 31 10 .10 0.80 .1/ 32, 10 .10 0.80 .10 1/ 32 Merging subnet masks can save ... jay. 03 /13 -17 :58 : 02. 52 0 000 xxx.xxx.xxx.xxx:36 922 -> xxx.xxx.xxx.xxx :23 TCP TTL:64 TOS:0x10 ID: 622 53 IpLen :20 DgmLen :53 DF ***AP*** Seq: 0x 158 07E79 Ack: 0x695B 229 5 Win: 0x1 920 TcpLen: 32 TCP ... =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ 03 /13 -17 :58 : 02. 53 0000 xxx.xxx.xxx.xxx:36 922 -> xxx.xxx.xxx.xxx :23 TCP TTL:64 TOS:0x10 ID: 622 54 IpLen :20 DgmLen: 52 DF ***A**** Seq: 0x 158 07E7A Ack: 0x695B 229 6 Win: 0x1 920 TcpLen: 32 TCP...

76

528

0

snort 2.1 intrusion detection second edition phần 9 pot

... –s 15 00 port 80 20 4 .17 4.x.x .53 573 > 68.48.x.x.80: S 3 728 59 51 0 9:3 728 59 51 0 9(0) win 58 40 68.48.x.x.80 > 20 4 .17 4.x.x .53 573: S 25 23 51 4 769 : 25 23 51 4 769(0) ack 3 728 59 51 1 0win 57 92 20 4 .17 4.x.x .53 573 ... 20 4 .17 4.x.x .53 573 > 68.48.x.x.80: . ack 358 win 64 32 20 4 .17 4.x.x .53 573 > 68.48.x.x.80: F 11 9 :11 9(0) ack 358 win 64 32 68.48.x.x.80 > 20 4 .17 4.x.x .53 573: F 358 : 358 (0) ack 12 0 win 57 92 ... 20 4 .17 4.x.x .53 573 > 68.48.x.x.80: . ack 1 win 58 40 20 4 .17 4.x.x .53 573 > 68.48.x.x.80: P 1: 119 (11 8) ack 1 win 58 40 0x0000 450 0 0000 0000 4000 320 6 2a68 ccae df18 E o@ .2. *h 0x0 010 0000 0000 d1 45 0 050 ...

76

318

0

snort 2.1 intrusion detection second edition phần 1 pptx

... Unregistered Version - http://www.simpopdf.com 29 5 _Snort_ 2e_ 01. qxd 5/ 4/04 4 :50 PM Page 12 12 Chapter 1 • Intrusion Detection Systems Figure 1. 1 NIDS Network INTERNET Mail DNS NIDS NIDS ... http://www.simpopdf.com 29 5 _Snort_ 2e_ 01. qxd 5/ 4/04 4 :50 PM Page 10 10 Chapter 1 • Intrusion Detection Systems ■ Network-Based Intrusion Detection System (NIDS) ■ Host-Based Intrusion Detection System ... Act of 19 68 (Title III), 18 U.S.C. §§ 25 10 25 22 and the Electronic www.syngress.com Simpo PDF Merge and Split Unregistered Version - http://www.simpopdf.com 29 5 _Snort2 e_TOC.qxd 5/ 5/04 7 :10 PM...

76

365

1

snort 2.1 intrusion detection second edition phần 2 ppt

... flushed packets: INACTIVE flush_data_diff_size: 50 0 Ports: 21 23 25 53 80 11 0 11 1 14 3 51 3 14 33 Emergency Ports: 21 23 25 53 80 11 0 11 1 14 3 51 3 14 33 HttpInspect Config: GLOBAL CONFIG Max Pipeline ... like that: 03 /11 - 12 : 44: 45. 424 5 51 0:A0:CC :29 :1D :13 -> 0 :20 :6F:3:7:CC type:0x800 len:0x7A 66.80 .14 6.8 :22 00 -> 69 .13 8 .22 5 .13 7: 12 8 9 TCP TTL:64 TOS:0x10 ID :5 52 8 IpLen :20 DgmLen :10 8 DF ***AP*** ... 0xF3 3 15 F 42 Ack: 0x5FAFDF2 Win: 0xE4B4 TcpLen: 20 E9 A2 19 CE 3A 0A C7 AA 75 EA 13 1D 02 6D 3C 12 : u m<. AA 96 1D F8 8E 73 C5 D1 B2 33 41 D4 88 DC A2 53 s 3A S CB 93 79 5E 1B FC 3A 5B 82 1E...

76

427

1

snort 2.1 intrusion detection second edition phần 1 potx

... 04/06 - 21 : 12 : 52 . 016 027 408 1 92. 16 8 .1. 1 01 - 1 92. 16 8 .1. 1 02 - ICMP Echo Reply 04/06 - 21 : 12 : 52 . 879979 3 82 1 92. 16 8 .1. 1 02 - 1 92. 16 8 .1. 1 01 - ICMP PING Windows 04/06 - 21 : 12 : 53 .009 929 408 1 92. 16 8 .1. 1 01 - 1 92. 16 8 .1. 1 02 ... 04/06 - 21 : 12 : 49.87 611 6 3 82 1 92. 16 8 .1. 1 02 - 1 92. 16 8 .1. 1 01 - ICMP PING Windows 04/06 - 21 : 12 : 50 .00 854 3 408 1 92. 16 8 .1. 1 01 - 1 92. 16 8 .1. 1 02 - ICMP Echo Reply 04/06 - 21 : 12 : 50 .877603 3 82 1 92. 16 8 .1. 1 02 - 1 92. 16 8 .1. 1 01 ... 1 92. 16 8 .1. 1 01 - ICMP PING Windows 04/06 - 21 : 12 : 51 . 008837 408 1 92. 16 8 .1. 1 01 - 1 92. 16 8 .1. 1 02 - ICMP Echo Reply 04/06 - 21 : 12 : 51 . 878793 3 82 1 92. 16 8 .1. 1 02 - 1 92. 16 8 .1. 1 01 - ICMP PING Windows 04/06 - 21 : 12 : 52 . 016 027 ...

76

670

0

snort 2.1 intrusion detection second edition phần 7 ppsx

... teardrop_attack_cap 16 : 52 : 06. 029 368 1 72. 16 .10 . 15 1 .1 0 25 > 1 72. 16 .10 .20 0 .13 5: [no cksum] udp 28 (frag 24 2:36@0+) (ttl 3, len 56 ) 16 : 52 : 06.0463 02 1 72. 16 .10 . 15 1 > 1 72. 16 .10 .20 0: (frag 24 2:4 @24 ) (ttl ... attack: Full Alert: [**] [11 3 :2: 1] (spp_frag2) Teardrop attack [**] 02/ 19 -16 : 52 : 06.0463 02 1 72. 16 .10 . 15 1 -> 1 72. 16 .10 .20 0 UDP TTL:3 TOS:0x0 ID :24 2 IpLen :20 DgmLen :24 Frag Offset: 0x0003 Frag ... spoofed? # snort –dvr teardrop_attack.cap 02/ 19 -16 : 52 : 06. 029 368 1 72. 16 .10 . 15 1 -> 1 72. 16 .10 .20 0 UDP TTL:3 TOS:0x0 ID :24 2 IpLen :20 DgmLen :56 MF Frag Offset: 0x0000 Frag Size: 0x0 024 04 01 00 87...

76

579

0

snort 2.1 intrusion detection second edition phần 8 pps

... http://www.simpopdf.com 29 5 _Snort2 e _10 .qxd 5/ 6/04 9: 51 AM Page 50 9Optimizing Snort • Chapter 10 50 9 12 : 24 :55 .969979 1 92. 16 8 .10 .13 .3093 > 1 92. 16 8.30 .17 1.ssh: P 72: 10 8(36) ack 1 win 16 1 92 (DF) **** ... 12 : 24: 52 . 970009 1 92. 16 8 .10 .13 .30 42 > 1 92. 16 8.30 .23 0.ssh: P 72: 10 8(36) ack 1 win 16 50 0 (DF) **** Press <ENTER> to send the next packet: 12 : 24: 52 . 979 929 1 92. 16 8.30 .23 0.ssh > 1 92. 16 8 .10 .13 .30 42: ... http://www.simpopdf.com 29 5 _Snort2 e _11 .qxd 5/ 5/04 6 :58 PM Page 5 51 Mucking Around with Barnyard • Chapter 11 5 51 [Classification: Misc activity] [Priority: 3] 03/06/04 -16 :11 :48.33 422 5 {TCP} 1 92. 16 8.69. 12 9 : 52 5 43...

76

524

0

snort 2.1 intrusion detection second edition phần 10 doc

... ml;.charset=iso- 20 4 .17 4.x.x.486 62 > 1 92. 16 8 .10 .20 .80: . ack 5 72 win 68 52 20 4 .17 4.x.x.486 62 > 1 92. 16 8 .10 .20 .80: F 11 9 :11 9(0) ack 5 72 win 68 52 1 92. 16 8 .10 .20 .80 > 20 4 .17 4.x.x.486 62: F 5 72: 5 72( 0) ack 12 0 win 57 92 20 4 .17 4.x.x.486 62 ... 656 5 656 5 656 5 656 5 656 5 656 5 eeeeeeeeeeee 0x0380 656 5 8 856 27 88 56 38 b20a 8 856 1d88 5 626 ee.V'.V8 V V& 0x0390 5b 31 c9 41 413 1 c0b0 05cd 8 050 89c3 31c9 [1. AA1 P 1. 0x03a0 31d2 b2 02 ... tests, 5 21 – 52 2 HPING and Cenzic, 51 7 – 51 9 IDS Informer, 496 50 0 IDS Wakeup, 5 01 5 02 overview of, 52 5 – 52 6 rule tests, 5 21 Sneeze, 5 02 50 3 Stick, Ftester, 51 9 stress testing, 52 0 – 5 21 TCPReplay,...

69

829

0