Snort 2.1 Intrusion Detection [With CDROM]

At the time of this review, the latest version of Snort is 2.3. However, the newest books(about two out there) on Snort, including this one, only covers up to version 2.1. And according to the Product Description, "in this community, major upgrades are noted by .x and not by full number upgrades as in 2.0 to 3.0". This pretty much means that this book is already out-dated, and it's printed in 2004, less than a year ago. This reminds me of when Linux was starting to get popular. Red Hat Linux went from version 6.2 to version 9.0 in just two years. Not to mention there are tons of books supposely dedicated to all those versions of Linux in the short two year period. Linux saved businesses a lot of money, and provided stability that MS Windows counterpart didn't. Snort will eventually replace or be at the same level as the current commercial Intrusion Detection Systems(IDS). I think this time the publishers are smarter, and recognized the pattern from their Linux frenzy publishing experience, lol. The old Linux books litter the thousands of bookstore shelves with nobody buying, lol. That's why at the moment there are very few books on Snort.

Now in an updated and expanded second edition Snort 2.1 Intrusion Detection offers completely up-to-date information and instruction ranging from the basics of installation, preprocessor configuraton, and optimization of the Snort software system. Enhanced with an accompanying CD-ROM, Snort 2.1 Intrusion Detection combines explict instructions for applying the software along with a wealth of sample code, tips, tricks, and techniques, and the option to participate in the Snort mailing list. A thorough and "user-friendly" introduction to a software option tailored especially guarding privacy and integrity in the digital age

If you want to know about Snort 2.1, one of the best open source intrusion detections systems available, then "Snort 2.1 Intrusion Detection, Second Edition" is the book you will want to have. This is an extensive examination of the Snort program and includes Snort 2.1 on CD with the Book. The authors start with defining what an intrusion detection system is, what it is not, and how placing it in your network at different points achieves different goals. This is followed by an introduction to Snort and a description of its capabilities and functions before getting into the nuts and bolts of installing and configuring it.One of the more difficult parts of Snort to understand is how to write the rules that determine when an intrusion has occurred. The authors do an excellent job of describing exactly how to write good rules to achieve the results you want. They even include an excellent section on how to deal with all that information you will be collecting. "Snort 2.1 Intrusion Detection, Second Edition" is highly recommended for anyone who wants a good, useful explanation of how an intrusion detection system should work and how to implement Snort to achieve that result.

The first version of this book is a "must have" for IDS users. The second proves to equally useful. This book is the quintessential resource for the Pig. There is information from the basic setup through integration with MySQL and ACID. I would strongly recommend this resource to anyone.

I was concerned this book may fall into the "second edition trap" of search and replace 2.0 with 2.1. Upon thorough reading, this is obviously not the case. The authors have thoroughly documented all new/enhanced features of 2.1, but more importantly they again break new ground by by providing unique, creative, and thoroughly useful information on things like writing rules, the intricacises of preprocessors, etc. They don't just teach you how to USE snort, they teach you how to think about using Snort (and other tools) to better defend your network. The chapter on Barnyard in particular was very interesting, and it's obvious from following following the Snort site/list that a lot of the new features were develped in conjunction with the writing of this book. So, this book isn't a re-hash of information, it's the definitive work from the creators.