Network intrusion detection

The Chief Information Warfare Officer for the entire United States teaches you how to protect your corporate network. This book is a training aid and reference for intrusion detection analysts. While the authors refer to research and theory, they focus their attention on providing practical information. The authors are literally the most recognized names in this specialized field, with unparalleled experience in defending our country's government and military computer networks. New to this edition is coverage of packet dissection, IP datagram fields, forensics, and snort filters.

Author Notes

About the Authors

Stephen Northcutt is a graduate of Mary Washington College. Beforeentering the field of computer security, he worked as a Navy helicopter searchand rescue crewman, white water raft guide, chef, martial arts instructor,cartographer, and network designer. Stephen is author/co-author of IncidentHandling Step by Step, Intrusion Signatures and Analysis, Inside NetworkPerimeter Security, and the previous two editions of this book. He was theoriginal author of the Shadow intrusion detection system and leader of theDepartment of Defense's Shadow Intrusion Detection team before acceptingthe position of Chief for Information Warfare at the Ballistic Missile DefenseOrganization. Stephen currently serves as Director of Training and Certificationfor the SANS Institute.

Judy Novak is currently a senior security analyst working for theBaltimore-based consulting firm of Jacob and Sundstrom, Inc. She primarily worksat the Johns Hopkins University Applied Physics Laboratory where she is involvedin intrusion detection and traffic monitoring and Information Operationsresearch. Judy was one of the founding members of the Army Research LabsComputer Incident Response Team where she worked for three years. She hascontributed to the development of a SANS course in TCP/IP and written a SANShands-on course, "Network Traffic Analysis Using tcpdump," both ofwhich are used in SANS certifications tracks. Judy is a graduate of theUniversity of Maryland--home of the 2002 NCAA basketball champions. She isan aging, yet still passionate, bicyclist, and Lance Armstrong is her modern-dayhero!

Excerpts

Introduction Our goal in writing Network Intrusion Detection, Third Edition has been toempower you as an analyst. We believe that if you read this book cover to cover,and put the material into practice as you go, you will be ready to enter theworld of intrusion analysis. Many people have read our books, or attended ourlive class offered by SANS, and the lights have gone on; then, they are off tothe races. We will cover the technical material, the workings of TCP/IP, andalso make every effort to help you understand how an analyst thinks throughdozens of examples. Network Intrusion Detection, Third Edition is offered in five parts. Part I,"TCP/IP," begins with Chapter 1, ranging from an introduction to thefundamental concepts of the Internet protocol to a discussion of RemoteProcedure Calls (RPCs). We realize that it has become stylish to begin a booksaying a few words about TCP/IP, but the system Judy and I have developed hasnot only taught more people IP but a lot more about IP as well--more thanany other system ever developed. We call it "real TCP" because thematerial is based on how packets actually perform on the network, not theory.Even if you are familiar with IP, give the first part of the book a look. We areconfident you will be pleasantly surprised. Perhaps the most important chapterin Part I is Chapter 5, "Stimulus and Response." Whenever you look ata network trace, the first thing you need to determine is if it is a stimulus ora response. This helps you to properly analyze the traffic. Please take the timeto make sure you master this material; it will prevent analysis errors as youmove forward. Tip Whenever you look at a network trace, thefirst thing you need to determine is if it is a stimulus or a response. The book continues in Part II, "Traffic Analysis" with a discussionof traffic analysis. By this, we mean analyzing the network traffic byconsideration of the header fields of the IP and higher protocol fields.Although ASCII and hex signatures are a critical part of intrusion detection,they are only tools in the analyst's tool belt. Also in Part II, we beginto show you the importance of each field, how they are rich treasures tounderstanding. Every field has meaning, and fields provide information bothabout the sender of the packet and its intended purpose. As this part of thebook comes to a close, we tell you stories from the perspective of an analystseeing network patterns for the first time. The goal is to help you prepare forthe day when you will face an unknown pattern. Although there are times a network pattern is so obvious it almost screamsits message, more often you have to search for events of interest. Sometimes,you can do this with a well-known signature, but equally often, you must searchfor it. Whenever attackers write software for denial of service, or exploits,the software tends to leave a signature that is the result of crafting thepacket. This is similar to the way that a bullet bears the marks of the barrelof the gun that fired it, and experts can positively identify the gun by thebullet. In Part III of the book, "Filters/Rules for NetworkMonitoring" we build the skills to examine any field in the packet and theknowledge to determine what is normal and what is anomalous. In this section, wepractice these skills both with TCPdump and also Snort. In Part IV, we consider the larger framework of intrusion detection. Wediscuss where you should place sensors, what a console needs to support for dataanalysis, and automated and manual response issues to intrusion detection. Inaddition, this section helps arm the analyst with information about how theintrusion detection capability fits in with the business model of theorganization. Finally, this book provides three appendixes that reference common signaturesof well-known reconnaissance, denial of service, and exploit scans. We believeyou will find this to be no fluff, packed with data from the first to the lastpage. Network Intrusion Detection, Third Edition has not been developed byprofessional technical writers. Judy and I have been working as analysts since1996 and have faced a number of new patterns. We are thankful for thisopportunity to share our experiences and insights with you and hope this bookwill be of service to you in your journey as an intrusion analyst. (c) Copyright Pearson Education. All rights reserved. Excerpted from Network Intrusion Detection: An Analyst's Handbook by Stephen Northcutt, Judy Novak All rights reserved by the original copyright owners. Excerpts are provided for display purposes only and may not be reproduced, reprinted or distributed without the written permission of the publisher.

I TCP/IP
1 Ip Concepts	p. 3
The TCP/IP Internet Model	p. 4
Packaging (Beyond Paper or Plastic)	p. 7
Addresses	p. 11
Service Ports	p. 15
IP Protocols	p. 16
Domain Name System	p. 18
Routing: How You Get There from Here	p. 19
Summary	p. 20
2 Introduction to TCPdump and TCP	p. 23
TCPdump	p. 24
Introduction to TCP	p. 31
TCP Gone Awry	p. 38
Summary	p. 42
3 Fragmentation	p. 43
Theory of Fragmentation	p. 44
Malicious Fragmentation	p. 53
Summary	p. 56
4 ICMP	p. 57
ICMP Theory	p. 58
Mapping Techniques	p. 61
Normal ICMP Activity	p. 65
Malicious ICMP Activity	p. 69
To Block or Not to Block	p. 76
Summary	p. 78
5 Stimulus and Response	p. 79
The Expected	p. 81
Protocol Benders	p. 88
Abnormal Stimuli	p. 92
Summary	p. 101
6 DNS	p. 103
Back to Basics: DNS Theory	p. 104
Using DNS for Reconnaissance	p. 115
Tainting DNS Responses	p. 119
Summary	p. 122
II Traffic Analysis
7 Packet Dissection Using TCPdump	p. 125
Why Learn to Do Packet Dissection?	p. 127
Sidestep DNS Queries	p. 129
Introduction to Packet Dissection Using TCPdump	p. 131
Where Does the IP Stop and the Embedded Protocol Begin?	p. 133
Other Length Fields	p. 133
Increasing the Snaplen	p. 135
Dissecting the Whole Packet	p. 137
Freeware Tools for Packet Dissection	p. 139
Summary	p. 142
8 Examining IP Header Fields	p. 143
Insertion and Evasion Attacks	p. 143
IP Header Fields	p. 147
The More Fragments (MF) Flag	p. 151
Summary	p. 159
9 Examining Embedded Protocol Header Fields	p. 161
TCP	p. 161
UDP	p. 178
ICMP	p. 181
Summary	p. 183
10 Real-World Analysis	p. 185
You've Been Hacked!	p. 186
Netbus Scan	p. 189
How Slow Can you Go?	p. 194
RingZero Worm	p. 197
Summary	p. 200
11 Mystery Traffic	p. 203
The Event in a Nutshell	p. 204
The Traffic	p. 204
DDoS or Scan	p. 205
Fingerprinting Participant Hosts	p. 210
Summary	p. 218
III Filters/Rules for Network Monitoring
12 Writing TCPdump Filters	p. 221
The Mechanics of Writing TCPdump Filters	p. 222
Bit Masking	p. 224
TCPdump IP Filters	p. 227
TCPdump UDP Filters	p. 229
TCPdump TCP Filters	p. 231
Summary	p. 236
13 Introduction to Snort and Snort Rules	p. 237
An Overview of Running Snort	p. 238
Snort Rules	p. 240
Summary	p. 248
14 Snort Rules--Part II	p. 249
Format of Snort Options	p. 250
Rule Options	p. 250
Putting It All Together	p. 266
Summary	p. 269
IV Intrusion Infrastructure
15 Mitnick Attack	p. 273
Exploiting TCP	p. 274
Detecting the Mitnick Attack	p. 285
Network-Based Intrusion-Detection Systems	p. 286
Host-Based Intrusion-Detection Systems	p. 288
Preventing the Mitnick Attack	p. 289
Summary	p. 290
16 Architectural Issues	p. 291
Events of Interest	p. 292
Limits to Observation	p. 294
Low-Hanging Fruit Paradigm	p. 296
Human Factors Limit Detects	p. 298
Severity	p. 300
Countermeasures	p. 303
Calculating Severity	p. 304
Sensor Placement	p. 307
Outside Firewall	p. 308
Push/Pull	p. 311
Analyst Console	p. 312
Host- or Network-Based Intrusion Detection	p. 316
Summary	p. 318
17 Organizational Issues	p. 319
Organizational Security Model	p. 320
Defining Risk	p. 324
Risk	p. 326
Defining the Threat	p. 332
Risk Management Is Dollar Driven	p. 336
How Risky Is a Risk?	p. 336
Summary	p. 338
18 Automated and Manual Response	p. 339
Automated Response	p. 341
Honeypot	p. 347
Manual Response	p. 349
Summary	p. 358
19 Business Case for Intrusion Detection	p. 359
Part 1 Management Issues	p. 361
Part 2 Threats and Vulnerabilities	p. 367
Part 3 Tradeoffs and Recommended Solution	p. 372
Repeat the Executive Summary	p. 377
Summary	p. 378
20 Future Directions	p. 379
Increasing Threat	p. 379
Defending Against the Threat	p. 383
Defense in Depth	p. 388
Emerging Techniques	p. 392
Summary	p. 396
V Appendixes
A Exploits and Scans to Apply Exploits	p. 401
False Positives	p. 401
IMAP Exploits	p. 409
Scans to Apply Exploits	p. 413
Single Exploit, Portmap	p. 417
Summary	p. 423
B Denial of Service	p. 425
Brute-Force Denial-of-Service Traces	p. 426
Elegant Kills	p. 430
nmap	p. 433
Distributed Denial-of-Service Attacks	p. 435
Summary	p. 438
Ctection of Intelligence Gathering	p. 439
Network and Host Mapping	p. 440
NetBIOS-Specific Traces	p. 450
Stealth Attacks	p. 452
Measuring Response Time	p. 457
Worms as Information Gatherers	p. 460
Summary	p. 464
Index	p. 465

Available:*

On Order

Summary

Summary

Author Notes

Excerpts

Excerpts

Table of Contents