- Training
- Training Live Events
- Training Without Travel
- SANS Courses
- SANS Curricula
- Certified Instructors
- Training Calendars
- SANS @Home
- SANS OnDemand
- Community SANS
- SANS Mentor Program
- Coins
- SANS Onsite
- SANS SelfStudy
- SANS Summit Series
- SANS Partnership Series
- Webcasts
- Work Study
- Events Archive
- DoD 8570
- Voucher Credit Program
- group discounts
- Certification
- Resources
- List of Resources
- Top 20 List
- Top 25 Programming Errors
- 20 Coolest Jobs
- Application Security Procurement Language
- Top 10 Security Trends
- Top 5 Essential Log Reports
- Reading Room
- Webcasts
- WhatWorks
- Newsletters
- RSS Feeds
- Calendar Feeds
- Security Thought Leaders
- Security Policy Project
- Security+ Study Guide
- SANS Buyers Guide
- Security Tool Demos
- 2008 Salary Survey
- Vendor
- Portal
- Storm Center
- College
- Developer
- About
the most trusted source for computer security training, certification and research
Intrusion Detection FAQ
The Internet's most trusted site for vendor neutral intrusion detection information.
Click here for Intrusion Detection In-Depth: The Most Advanced Intrusion Detection Immersion Training Available
The Basics
- What is Intrusion Detection?
- How can I contribute to the FAQ?
- Books on or related to Intrusion Detection and Prevention
- Can I use a MAC Address in Intrusion Detection?
- I keep seeing network mapping attempts, should I be concerned?
- How is a tool like an integrity checker used in Intrusion Detection?
- What open standards exist for Intrusion Detection?
- How do you deploy network based Intrusion Detection Systems in a switched network?
- What is a Honeypot?
- What is a honeypot and how is it used?
- What is a honeypot? Why do I need one?
- Why should I not run a honeypot?
- If someone from a large organization called and asked you for advice on what he or she should do first to get started on Intrusion Detection, what one thing would you recommend?
- Should communication between the sensor (or agent) and the monitor be encrypted?
- Why is intrusion detection required in today's computing environment?
- Can the volume of network traffic get high enough to exceed the capability of the detectors?
- If hackers break into my network, how would the press ever find out and why would anybody else care?
- What is the risk to Windows 9x from Dedicated Internet Connections?
- Why your switched network isn't secure.
- What Do You Do After You Deploy the Intrusion Detection System?
- Are there limitations of Intrusion Signatures?
- What should I do to mitigate false positives?
- What are the differences between Network Intrusion Detection and Network Intrusion Prevention?
- What is a Host Intrusion Detection System?
Terms, Theory and Research
- What is Intrusion Detection?
- What is host based Intrusion Detection?
- What is network based Intrusion Detection?
- What is a layered defense?
- What is knowledge based Intrusion Detection?
- What is behavior based Intrusion Detection?
- The Importance of Intrusion Detection
- What is a false positive and why are false positives a problem?
- What is a false negative?
- Why do I get so many false positives?
- What is a bastion host?
- A Taxonomy of Intrusion Detection Techniques
- What Do People Mean by Socks?
- Data Mining in Intrusion Detection
- Statistical based approach to Intrusion Detection
- Can you explain traffic analysis and anomaly detection?
- What is covert channel and what are some examples?
- How does Fragroute evade NIDS detection?
- What is polymorphic shell code and what can it do?
- Intrusion Detection System Evasion and Denial of Service Using RPC Design Flaws
- How does an attacker evade Intrusion Detection Systems with Session Splicing?
- Are there tools to visualize the data from an intrusion detection system?
- How to place Intrusion Detection System sensor in redundant networks?
- Intrusion detection on wireless network?
- What is Meta-Intrusion Detection Systems?
Scanners and Scan Patterns
- What is nmap and what does it do?
- Can fragments help attackers evade detection?
- What was the Ring Zero scan?
- I am seeing odd ICMP traffic, what could this mean?
- Computer Associates RCO Option
- RPC and NMAP Patterrns
- Port 1080 and 23, and IRC Server Signature
- What Do These PC Anywhere Reports Mean? (See: Paranoid PC Anywhere in the Information Security Reading Room for more information)
- Port 1600 Scan
- Port 137 Scan
- TCP/IP Stack Fingerprinting Principles
- Passive Fingerprinting Utilizing the Telnet Protocol Negotiation data
- How can attacker use ICMP for reconnaissance?
- What is p0f and what does it do?
- How can passive techniques be used to audit and discover network vulnerability?
- What is XProbe?
- Reconnaissance Techniques using Spoofed IP Addresses
- What is Remote Identification, Next Generation (RING)?
- What is AMap and how does it fingerprint applications?
- What is Scanrand?
Management and Legal Issues
- How do I get support from an ISP to investigate an incident?
- How do I convince my boss/manager/supervisor/board of directors to pay for an Intrusion Detection System (IDS)?
- How to make the business case for an Intrusion Detection System?
- Is port scanning legal?
- Should we outsource monitoring?
- What is MSSP (Managed Security Service Provider) and how can it help my organization?
Incident Handling and Response
- What are the steps to handle an incident?
- What do I have to do to preserve evidence?
- What was the Melissa virus and what can we learn from it?
- Who do I contact when I receive unusual traffic from a host?
- Preventing SYN Flooding with Cisco Routers
- What difficulties are associated on matching events with attacks. Why is event/data correlation important?
- Network Intrusion and use of automated responses
- What is Active Response?
- What is the Role of Security Event Correlation in Intrusion Detection?
NT Specific Questions
- How do I do logging with NT?
- What is an NBT name?
- I ran netstat on my NT server and see all these active ports, how can I find out what they are for?
- Running Snort under Windows
Unix Specific Questions
- What are signs a Unix system is compromised?
- Do telnet and rlogin increase the risk of compromise?
- Is it really important to make sure the root account has a history file?
- Do I "really" need to install patches to my system? I don't run the services/products that patches were issued for.
- Is blocking port 111 sufficient to protect your systems from RPC attacks?
- I am seeing a PAM error message, what does it mean?
- How to Examine a Unix Box for Possible Compromise
- Knark: Linux Kernel Subversion
- Build Securely Snort with Sguil Sensor Step-by-Step Powered by Slackware Linux
Intrusion Detection Products
- What are common attacker tools?
- Which backdoors live on which ports?
- Verifying Files with Red Hat's RPM
- Finding Listening Applications on Windows
- Why egress filtering benefits your organization
- Setting up a simple inexpensive ($39.95) host intrusion detection system.
- What are some emerging options for Network Intrusion Detection Systems?
- How to Evaluate Network Intrusion Detection Systems?
- Deploying Open Sourced Network Intrusion Detection for the Enterprise
Attack Examples
- Analysis of the Type0 (Class 0) DNS that has been detected, version 1.0
- Linux System Compromise
- A Look at Deep Throat
- Analysis of a fingerd replacement
- The "stacheldraht" Distributed Denial of Service Attack Tool
- Analysis of Rootkit/Smurf Payload Toolkit v 1.1
- The trouble with RPCs
- SubSeven Trojan v 2.1
- Analysis of N.F.O hacking- / rootkit
- Distributed Denial of Service Attack Tools: trinoo and wintrinoo
- Using SNMP for Reconnaissance
- Detecting Trojan Programs that Use Email to Remotely Monitor Victim Systems
- What is the TSIG vulnerability?
- The Zombie Scan of June/July 2001
- What are unicode vulnerabilities on Internet Information Server (IIS)?
- What is the Q Trojan?
- An analysis of SQL.Spider-B (Digispid.B.Worm, Spida, MSSQL Worm and SQLSnake)
Check Them Out!
SANS provides an unbiased view of the technical issues we face today.
-Mark Towers, Nokia
- © 2000-2009 The SANS™ Institute
- Web Privacy Policy | Web Contact |
- Press Room | Trademark Usage Policy