Intrusion-detection systems (IDS) have a mixed reputation in the world of enterprise IT. Many IDSs have been accused of being overly sensitive and flooding system administrators with false alerts. They are also notoriously tough to manage. On the other hand, such . . .
Intrusion-detection systems (IDS) have a mixed reputation in the world of enterprise IT. Many IDSs have been accused of being overly sensitive and flooding system administrators with false alerts. They are also notoriously tough to manage. On the other hand, such vendors as Symantec (Nasdaq: SYMC) and Network Associates (NYSE: NET) have gone out of their way to gobble up makers of intrusion-detection products, believing that they will become a must-have for an organization's security arsenal. In the meantime, however, many organizations are still on the fence about intrusion detection. For them, the answer may lie with a product called "Snort," an open-source IDS distributed under the GNU GPL license by Martin Roesch, its creator. Snort allows IT organizations to start detecting intruders on the cheap, and it is a powerful program with a large following. But Snort is far from perfect, and potential users need to be aware of both its strengths and weaknesses. In short, Snort is capable of performing real-time traffic analysis and packet logging on IP networks. It uses protocol analysis and content matching to detect attacks and probes, such as buffer overflows, stealth port scans, CGI attacks, SMB probes and others. Snort also boasts real-time alerting capabilities for Syslog, user-specified files, or via other means. Primarily, it is used as a straight packet sniffer, a packet logger for network traffic debugging, or as a full-blown intrusion-detection system.
Read this full article at Newsfactor
Only registered users can write comments.
Please login or register. Powered by AkoComment! |
