Snort
Z WiKi AIRdump.CZ
Snort provádí analýzu protokolu, vyhledávaní (porovnávaní) obsahu, a tato technologie je převážně používana pro aktivní blokování nebo pasivní detekcicelé škály útoků a pokusů jako buffer overflow, stealth port scan, atakování webových aplikací, SMB probes a snímaní fingerprintů operačních systémů (pouze část dovedností). The software is mostly used for intrusion prevention purposes, by dropping attacks as they are taking place. Snort™ can be combined with other software such as SnortSnarf, sguil, OSSIM, and the Basic Analysis and Security Engine (BASE) to provide a visual representation of intrusion data. With patches for the Snort source from Bleeding Edge Threats, support for packet stream antivirus scanning with ClamAV and network abnormality with SPADE in network layers 3 and 4 is possible with historical observation. ( These patches seem to be no longer maintained )
Sourcefire became public in 2007 (NASD:FIRE) after Check Point's attempt to acquire it in 2005 fell through as both companies mutually withdrew from the acquisition process. Sourcefire recently purchased the ClamAV open source project.
Externí odkazy
- Webová stránka Snort
- Sourcefire - Společnost která vlastní a vyvíjí Snort.
- The Bleeding Edge Threats - Community maintained Snort rule sets.
Uživatelské rozhraní pro Snort
Svobodné
- Sguil - An open source Tcl/Tk interface for network security monitoring
- Basic Analysis and Security Engine - An open source based Snort DB web analysis tool, replaces ACID.
Komerční
- Sourcefire - Enterprise intrusion prevention at speeds up up to 10Gigabit from the makers of Snort
- Applied Watch Command Center - Enterprise Open Source Security Management Suite for Snort™ (Free Version, and a Pay version)
- IDS Policy Manager - Snort Rules Management
- CEREBUS - ncurses command shell browser of unified Snort logs.
Nástroje pro použití se Snort
- SnortUnified perl modules - Nástroje na zpracování Snort unified a unified2 logů
