Snort 2.1 Intrusion Detection, Second Edition

Rating:
Summary: Great Resource
Review: I helped write this book, the brainchild of editor and co-author Brian Caswell. Brian's the most excellent Snort Rules king, as well as an employee at Sourcefire. Mike Poor, of SANS fame, and Toby Kohlenberg, an extremely capable and enterprise-experienced IDS guy, also edited. The author team on this massively-updated book includes several other people with amazing experience and drive to make a great book.

I like to think that, following Brian's design, we've created a book that's useful to experienced Snorters to new IDS users to programmers. Heck, Andrew Baker, in writing his chapter on Barnyard, actually developed major changes to the tool in response to the questions he raised as he wrote.

Rating:
Summary: mighty impressive second edition
Review: I was concerned this book may fall into the "second edition trap" of search and replace 2.0 with 2.1. Upon thorough reading, this is obviously not the case. The authors have thoroughly documented all new/enhanced features of 2.1, but more importantly they again break new ground by by providing unique, creative, and thoroughly useful information on things like writing rules, the intricacises of preprocessors, etc. They don't just teach you how to USE snort, they teach you how to think about using Snort (and other tools) to better defend your network. The chapter on Barnyard in particular was very interesting, and it's obvious from following following the Snort site/list that a lot of the new features were develped in conjunction with the writing of this book. So, this book isn't a re-hash of information, it's the definitive work from the creators.

Rating:
Summary: mighty impressive second edition
Review: I was concerned this book may fall into the "second edition trap" of search and replace 2.0 with 2.1. Upon thorough reading, this is obviously not the case. The authors have thoroughly documented all new/enhanced features of 2.1, but more importantly they again break new ground by by providing unique, creative, and thoroughly useful information on things like writing rules, the intricacises of preprocessors, etc. They don't just teach you how to USE snort, they teach you how to think about using Snort (and other tools) to better defend your network. The chapter on Barnyard in particular was very interesting, and it's obvious from following following the Snort site/list that a lot of the new features were develped in conjunction with the writing of this book. So, this book isn't a re-hash of information, it's the definitive work from the creators.

Rating:
Summary: Detailed information for IDS systems and Snort in particular
Review: If you want to know about Snort 2.1, one of the best open source intrusion detections systems available, then "Snort 2.1 Intrusion Detection, Second Edition" is the book you will want to have. This is an extensive examination of the Snort program and includes Snort 2.1 on CD with the Book.

The authors start with defining what an intrusion detection system is, what it is not, and how placing it in your network at different points achieves different goals. This is followed by an introduction to Snort and a description of its capabilities and functions before getting into the nuts and bolts of installing and configuring it.

One of the more difficult parts of Snort to understand is how to write the rules that determine when an intrusion has occurred. The authors do an excellent job of describing exactly how to write good rules to achieve the results you want. They even include an excellent section on how to deal with all that information you will be collecting.

"Snort 2.1 Intrusion Detection, Second Edition" is highly recommended for anyone who wants a good, useful explanation of how an intrusion detection system should work and how to implement Snort to achieve that result.

Rating:
Summary: Detailed information for IDS systems and Snort in particular
Review: If you want to know about Snort 2.1, one of the best open source intrusion detections systems available, then "Snort 2.1 Intrusion Detection, Second Edition" is the book you will want to have. This is an extensive examination of the Snort program and includes Snort 2.1 on CD with the Book.

The authors start with defining what an intrusion detection system is, what it is not, and how placing it in your network at different points achieves different goals. This is followed by an introduction to Snort and a description of its capabilities and functions before getting into the nuts and bolts of installing and configuring it.

One of the more difficult parts of Snort to understand is how to write the rules that determine when an intrusion has occurred. The authors do an excellent job of describing exactly how to write good rules to achieve the results you want. They even include an excellent section on how to deal with all that information you will be collecting.

"Snort 2.1 Intrusion Detection, Second Edition" is highly recommended for anyone who wants a good, useful explanation of how an intrusion detection system should work and how to implement Snort to achieve that result.

Rating:
Summary: A thorough and "user-friendly" introduction
Review: Now in an updated and expanded second edition Snort 2.1 Intrusion Detection offers completely up-to-date information and instruction ranging from the basics of installation, preprocessor configuraton, and optimization of the Snort software system. Enhanced with an accompanying CD-ROM, Snort 2.1 Intrusion Detection combines explict instructions for applying the software along with a wealth of sample code, tips, tricks, and techniques, and the option to participate in the Snort mailing list. A thorough and "user-friendly" introduction to a software option tailored especially guarding privacy and integrity in the digital age

Rating:
Summary: Still the best Snort book, but not as good as it should be
Review: Syngress published "Snort 2.0" in Mar 03, and I gave it a four star review in Jul 03. Excerpts from that review appear on the back cover and first page of "Snort 2.1," published only 14 months later. I still think "Snort 2.1" is overall the best Snort book available, but I was disappointed by signs of rushed production and lack of coverage of key Snort features.

The table of contents for "Snort 2.1" is deceiving, as it is almost exactly the same as "Snort 2.0." However, the new book is almost 200 pages larger than its predecessor, with many internal modifications. Chapters 1, 2, 3, 4, 9, 11, 12 and 13 are either completely new or substantially new. Chapters 5, 6, 7, 8, and 10 are either partial rewrites or have some material added or dropped. Despite all of this work, "Snort 2.1" fails to spend time on key subjects, which I will mention during a chapter-by-chapter examination of the book.

First, I recommend skipping ch 1. Aside from some general IDS advice, it is haphazard and contributes nothing to the core Snort discussion. Ch 2 is a quick overview of Snort capabilities, and should have been the lead chapter. Ch 3 describes Snort installation, but suffers apparently swapped figures (3.1 and 3.2) and a wrong figure (3.5). Ch 3 is still a nice upgrade from its counterpart in "Snort 2.0," which gave hints for deploying Snort on Red Hat Linux 8.0. The new ch 3 covers Linux, OpenBSD, and Windows.

Ch 4, "Inner Workings," is one of the reasons "Snort 2.1" has an advantage over the competition. It's tough to go wrong when Snort's developers describe the tool's operation. Still, signs of rough editing appear on p. 170 and 191, and the "-a cmg" switch should be "-A cmg".

Ch 5 covers rules, and is a big disappointment. For most users, rules are the primary means to customize Snort. Like "Snort 2.0," ch 5 fails to help readers with some of the more important new Snort rule options, like byte_test, byte_jump, distance, and within (available since 2.0.rc1 in Mar 03). Ch 5 implies on p. 145 that running Snort with -v is a good idea, despite every other recommendation in the book that verbose mode is a performance killer. Also, the IP "sec" option mentioned on p. 205 is not "IPSec" -- see RFC 791. Overall, ch 5 spends too much time restating rule information found in Snort's manual, and not enough time on features available even in Snort 2.0.

Ch 6's discussion of preprocessors is a solid chapter, with new material on Snort's flow module, http_inspect, and perfmonitor. The telnet preprocessor section is one of the better examples of a "code walkthrough," where the author shows code while explaining what it does.

Ch 7 is really showing its age. "Snort 2.0" was behind the times when it said "Unified logs are the future of Snort reporting," and "Snort 2.1" makes the same mistake. Barnyard, a means to read unified logs, was available in Sep 01! Ch 7 also misses the boat on XML output, calling it "our favorite and relatively new logging format" on p. 322. The XML plug-in spo_xml wasn't even part of snort-2.0.0, never mind snort-2.1.0. Basic research would have revealed Joe McAlerney's announcement of Silicon Defense's snort-idmef XML plug-in in Jun 01, followed by Sandro Poppi's assumption of the project in Aug 03. A mention of Barnyard's "XML formatting capabilities" appears in ch 7 on p. 322, yet Barnyard does not offer this natively.

I was happy to see Sguil addressed in ch 8, but sad to see Sguil's use of session and full content data not appreciated for its true worth. Ch 9 does a good job describing Oinkmaster and gives sound advice on avoiding the "not any" rule negation problem. Ch 10 covers really old testing tools like Sneeze, whose stateless operation cannot fool stream4's stateful inspection.

Ch 11, explaining Barnyard, is clearly the book's shining moment. This is the reason I read "Snort 2.1": Barnyard's author, Andrew Baker, describes Barnyard's history, the format of unified logs, and how best to use his contribution to Snort. Bravo. Ch 12 was also very good, using case studies to compare three different "active response" choices. Ch 13 was new but not exceptionally helpful.

I would enjoy seeing three improvements in the third edition. First, thoroughly scrub the book for old information. Watch out for people writing about "Cerebus" or http_decode or offerings from Silicon Defense, whose Web site disappeared in early 2004. Second, tell people to read the excellent Snort manual before reading the book. There's no need to address topics well-covered in the manual, like all of the IP- and TCP-based rule options. Third, ditch the existing rules chapter in favor of two new ones, one explaining principles via existing rules, and one showing advanced rule development.

I still recommend buying this book, but you might guide your reading choices by the comments in this review.

Rating:
Summary: Still the best Snort book, but not as good as it should be
Review: Syngress published "Snort 2.0" in Mar 03, and I gave it a four star review in Jul 03. Excerpts from that review appear on the back cover and first page of "Snort 2.1," published only 14 months later. I still think "Snort 2.1" is overall the best Snort book available, but I was disappointed by signs of rushed production and lack of coverage of key Snort features.

The table of contents for "Snort 2.1" is deceiving, as it is almost exactly the same as "Snort 2.0." However, the new book is almost 200 pages larger than its predecessor, with many internal modifications. Chapters 1, 2, 3, 4, 9, 11, 12 and 13 are either completely new or substantially new. Chapters 5, 6, 7, 8, and 10 are either partial rewrites or have some material added or dropped. Despite all of this work, "Snort 2.1" fails to spend time on key subjects, which I will mention during a chapter-by-chapter examination of the book.

First, I recommend skipping ch 1. Aside from some general IDS advice, it is haphazard and contributes nothing to the core Snort discussion. Ch 2 is a quick overview of Snort capabilities, and should have been the lead chapter. Ch 3 describes Snort installation, but suffers apparently swapped figures (3.1 and 3.2) and a wrong figure (3.5). Ch 3 is still a nice upgrade from its counterpart in "Snort 2.0," which gave hints for deploying Snort on Red Hat Linux 8.0. The new ch 3 covers Linux, OpenBSD, and Windows.

Ch 4, "Inner Workings," is one of the reasons "Snort 2.1" has an advantage over the competition. It's tough to go wrong when Snort's developers describe the tool's operation. Still, signs of rough editing appear on p. 170 and 191, and the "-a cmg" switch should be "-A cmg".

Ch 5 covers rules, and is a big disappointment. For most users, rules are the primary means to customize Snort. Like "Snort 2.0," ch 5 fails to help readers with some of the more important new Snort rule options, like byte_test, byte_jump, distance, and within (available since 2.0.rc1 in Mar 03). Ch 5 implies on p. 145 that running Snort with -v is a good idea, despite every other recommendation in the book that verbose mode is a performance killer. Also, the IP "sec" option mentioned on p. 205 is not "IPSec" -- see RFC 791. Overall, ch 5 spends too much time restating rule information found in Snort's manual, and not enough time on features available even in Snort 2.0.

Ch 6's discussion of preprocessors is a solid chapter, with new material on Snort's flow module, http_inspect, and perfmonitor. The telnet preprocessor section is one of the better examples of a "code walkthrough," where the author shows code while explaining what it does.

Ch 7 is really showing its age. "Snort 2.0" was behind the times when it said "Unified logs are the future of Snort reporting," and "Snort 2.1" makes the same mistake. Barnyard, a means to read unified logs, was available in Sep 01! Ch 7 also misses the boat on XML output, calling it "our favorite and relatively new logging format" on p. 322. The XML plug-in spo_xml wasn't even part of snort-2.0.0, never mind snort-2.1.0. Basic research would have revealed Joe McAlerney's announcement of Silicon Defense's snort-idmef XML plug-in in Jun 01, followed by Sandro Poppi's assumption of the project in Aug 03. A mention of Barnyard's "XML formatting capabilities" appears in ch 7 on p. 322, yet Barnyard does not offer this natively.

I was happy to see Sguil addressed in ch 8, but sad to see Sguil's use of session and full content data not appreciated for its true worth. Ch 9 does a good job describing Oinkmaster and gives sound advice on avoiding the "not any" rule negation problem. Ch 10 covers really old testing tools like Sneeze, whose stateless operation cannot fool stream4's stateful inspection.

Ch 11, explaining Barnyard, is clearly the book's shining moment. This is the reason I read "Snort 2.1": Barnyard's author, Andrew Baker, describes Barnyard's history, the format of unified logs, and how best to use his contribution to Snort. Bravo. Ch 12 was also very good, using case studies to compare three different "active response" choices. Ch 13 was new but not exceptionally helpful.

I would enjoy seeing three improvements in the third edition. First, thoroughly scrub the book for old information. Watch out for people writing about "Cerebus" or http_decode or offerings from Silicon Defense, whose Web site disappeared in early 2004. Second, tell people to read the excellent Snort manual before reading the book. There's no need to address topics well-covered in the manual, like all of the IP- and TCP-based rule options. Third, ditch the existing rules chapter in favor of two new ones, one explaining principles via existing rules, and one showing advanced rule development.

I still recommend buying this book, but you might guide your reading choices by the comments in this review.