Intrusion Detection FAQ

The Internet's most trusted site for vendor neutral intrusion detection information.

Updated November 2009 (View Press Release)

Click here for Intrusion Detection In-Depth: The Most Advanced Intrusion Detection Immersion Training Available

The Basics

• What is Intrusion Detection?
• How can I contribute to the FAQ?
• Books on or related to Intrusion Detection and Prevention
• Can I use a MAC Address in Intrusion Detection?
• I keep seeing network mapping attempts, should I be concerned?
• How is a tool like an integrity checker used in Intrusion Detection?
• What open standards exist for Intrusion Detection?
• How do you deploy network based Intrusion Detection Systems in a switched network?
• What is a Honeypot?
• What is a honeypot and how is it used?
• What is a honeypot? Why do I need one?
• Why should I not run a honeypot?
• If someone from a large organization called and asked you for advice on what he or she should do first to get started on Intrusion Detection, what one thing would you recommend?
• Should communication between the sensor (or agent) and the monitor be encrypted?
• Why is intrusion detection required in today's computing environment?
• Can the volume of network traffic get high enough to exceed the capability of the detectors?
• If hackers break into my network, how would the press ever find out and why would anybody else care?
• What is the risk to Windows 9x from Dedicated Internet Connections?
• Why your switched network isn't secure.
• What Do You Do After You Deploy the Intrusion Detection System?
• Are there limitations of Intrusion Signatures?
• What should I do to mitigate false positives?
• What are the differences between Network Intrusion Detection and Network Intrusion Prevention?
• What is a Host Intrusion Detection System?
• What is the Difference Between an IPS and a Web Application Firewall?
• What is the Difference Between an IPS and a Network Based Database Activity Monitor?
• Mapping Active Ports To Corresponding Processes
• What is Geolocation and How Does it Apply to Network Detection?

Terms, Theory and Research

• What is Intrusion Detection?
• What is host based Intrusion Detection?
• What is network based Intrusion Detection?
• What is a layered defense?
• What is knowledge based Intrusion Detection?
• What is behavior based Intrusion Detection?
• The Importance of Intrusion Detection
• What is a false positive and why are false positives a problem?
• What is a false negative?
• Why do I get so many false positives?
• What is a bastion host?
• A Taxonomy of Intrusion Detection Techniques
• What Do People Mean by Socks?
• Data Mining in Intrusion Detection
• Statistical based approach to Intrusion Detection
• Can you explain traffic analysis and anomaly detection?
• What is covert channel and what are some examples?
• How does Fragroute evade NIDS detection?
• What is polymorphic shell code and what can it do?
• Intrusion Detection System Evasion and Denial of Service Using RPC Design Flaws
• How does an attacker evade Intrusion Detection Systems with Session Splicing?
• Are there tools to visualize the data from an intrusion detection system?
• How to place Intrusion Detection System sensor in redundant networks?
• Intrusion detection on wireless network?
• What is Meta-Intrusion Detection Systems?
• Using Snort to Detect Clear Text Credit Card Numbers

Scanners and Scan Patterns

• What is nmap and what does it do?
• Can fragments help attackers evade detection?
• What was the Ring Zero scan?
• I am seeing odd ICMP traffic, what could this mean?
• Computer Associates RCO Option
• RPC and NMAP Patterns
• Port 1080 and 23, and IRC Server Signature
• What Do These PC Anywhere Reports Mean? (See: Paranoid PC Anywhere in the Information Security Reading Room for more information)
• Port 1600 Scan
• Port 137 Scan
• TCP/IP Stack Fingerprinting Principles
• Passive Fingerprinting Utilizing the Telnet Protocol Negotiation data
• How can attacker use ICMP for reconnaissance?
• What is p0f and what does it do?
• How can passive techniques be used to audit and discover network vulnerability?
• What is XProbe?
• Reconnaissance Techniques using Spoofed IP Addresses
• What is Remote Identification, Next Generation (RING)?
• What is AMap and how does it fingerprint applications?
• What is Scanrand?

Management and Legal Issues

• How do I get support from an ISP to investigate an incident?
• How do I convince my boss/manager/supervisor/board of directors to pay for an Intrusion Detection System (IDS)?
• How to make the business case for an Intrusion Detection System?
• Is port scanning legal?
• Should we outsource monitoring?
• What is MSSP (Managed Security Service Provider) and how can it help my organization?

Incident Handling and Response

• What are the steps to handle an incident?
• What do I have to do to preserve evidence?
• What was the Melissa virus and what can we learn from it?
• Who do I contact when I receive unusual traffic from a host?
• Preventing SYN Flooding with Cisco Routers
• What difficulties are associated on matching events with attacks. Why is event/data correlation important?
• Network Intrusion and use of automated responses
• What is Active Response?
• What is the Role of Security Event Correlation in Intrusion Detection?
• What is The Role of a SIEM in Detecting Events of Interest?
• Detecting Conficker with NMap

NT Specific Questions

• How do I do logging with NT?
• What is an NBT name?
• I ran netstat on my NT server and see all these active ports, how can I find out what they are for?
• Running Snort under Windows
• What Logging Would You Recommend for Windows
• What is an NBT (NetBIOS) Name?

Unix Specific Questions

• What are signs a Unix system is compromised?
• Do telnet and rlogin increase the risk of compromise?
• Is it really important to make sure the root account has a history file?
• Do I "really" need to install patches to my system? I don't run the services/products that patches were issued for.
• Is blocking port 111 sufficient to protect your systems from RPC attacks?
• I am seeing a PAM error message, what does it mean?
• How to Examine a Unix Box for Possible Compromise
• Knark: Linux Kernel Subversion
• Build Securely Snort with Sguil Sensor Step-by-Step Powered by Slackware Linux

Intrusion Detection Products

• How do I Tie the Identity of the Person Behind the Network Activity I Detect?
• What Are the Top Selling IDS/IPS and What Differentiates Them From Each Other?
• What are common attacker tools?
• Which backdoors live on which ports?
• Verifying Files with Red Hat's RPM
• Finding Listening Applications on Windows
• Why egress filtering benefits your organization
• Setting up a simple inexpensive ($39.95) host intrusion detection system.
• What are some emerging options for Network Intrusion Detection Systems?
• How to Evaluate Network Intrusion Detection Systems?
• Deploying Open Sourced Network Intrusion Detection for the Enterprise

Attack Examples

• Analysis of the Type0 (Class 0) DNS that has been detected, version 1.0
• Linux System Compromise
• A Look at Deep Throat
• Analysis of a fingerd replacement
• The "stacheldraht" Distributed Denial of Service Attack Tool
• Analysis of Rootkit/Smurf Payload Toolkit v 1.1
• The trouble with RPCs
• SubSeven Trojan v 2.1
• Analysis of N.F.O hacking- / rootkit
• Distributed Denial of Service Attack Tools: trinoo and wintrinoo
• Using SNMP for Reconnaissance
• Detecting Trojan Programs that Use Email to Remotely Monitor Victim Systems
• What is the TSIG vulnerability?
• The Zombie Scan of June/July 2001
• What are unicode vulnerabilities on Internet Information Server (IIS)?
• What is the Q Trojan?
• An analysis of SQL.Spider-B (Digispid.B.Worm, Spida, MSSQL Worm and SQLSnake)

Updated November 18, 2009