Catalog > All Topics

Securing Cisco Networks with Open Source Snort (SSFSNORT)

Cisco
4 Days
Download Course Outline
$3,600.00
Request a Quote
36 Learning Credits
Share
Related Topics
Schedule
Export to CSV
  • No schedule events found for this course.
      • PC
        Private Class
        Privately train a group of your employees at your facility, virtually, or any of our locations.
    Request
  • LCLive Classroom
    Live Classroom
    Learn and interact with your instructor and peers in-person in our classrooms.
  • VCVirtual Classroom
    Virtual Classroom
    Attend any of our instructor-led classes virtually regardless of your physical location.
  • PCPrivate Class
    Private Class
    Privately train a group of your employees at your facility, virtually, or any of our locations.
  • GTRGuaranteed to Run
    Guaranteed to Run
    GTR classes are guaranteed to run as promised and delivered.
Course Summary
Show All

Description

The Securing Cisco Networks with Open Source Snort (SSFSNORT) v2.1 course shows you how to deploy a network intrusion detection system based on Snort. You’ll learn how to install, configure, operate, and manage a Snort system, rules writing with an overview of basic options, advanced rules writing, how to configure Pulled Pork, and how to use OpenAppID to provide protection of your network from malware. You will learn techniques of tuning and performance monitoring, traffic flow through Snort rules, and more.

Objectives

After taking this course, you should be able to:

  • Describe Snort technology and identify resources available for maintaining a Snort deployment
  • Install Snort on a Linux-based operating system
  • Describe the Snort operation modes and their command-line options
  • Describe the Snort intrusion detection output options
  • Download and deploy a new rule set to Snort
  • Describe and configure the snort.conf file
  • Configure Snort for inline operation and configure the inline-only features
  • Describe the Snort basic rule syntax and usage
  • Describe how traffic is processed by the Snort engine
  • Describe several advanced rule options used by Snort
  • Describe OpenAppID features and functionality
  • Describe how to monitor Snort performance and how to tune rules

Prerequisites

To fully benefit from this course, you should have:

  • Technical understanding of TCP/IP networking and network architecture
  • Proficiency with Linux and UNIX text editing tools (vi editor is suggested by not required)

Who Should Attend

This course is for technical professionals who need to know how to deploy open source intrusion detection systems (IDS) and intrusion prevention systems (IPS), and how to write Snort rules.

  • Security administrators
  • Security consultants
  • Network administrators
  • System engineers
  • Technical support personnel
  • Channel partners and resellers

Outline

Course outline

  • Introduction to Snort Technology
  • Snort Installation
  • Snort Operation
  • Snort Intrusion Detection Output
  • Rule Management
  • Snort Configuration
  • Inline Operation and Configuration
  • Snort Rule Syntax and Usage
  • Traffic Flow Through Snort Rules
  • Advanced Rule Options
  • OpenAppID Detection
  • Tuning Snort
 
Lab outline
  • Connecting to the Lab Environment
  • Snort Installation
  • Snort Operation
  • Snort Intrusion Detection Output
  • Pulled Pork Installation
  • Configuring Variables
  • Reviewing Preprocessor Configurations
  • Inline Operations
  • Basic Rule Syntax and Usage
  • Advanced Rule Options
  • OpenAppID
  • Tuning Snort

Lab Outline

Lab 1: Install Snort and Its Components (Module 3)
Lab 2: Barnyard2 Installation (Module 4)
Lab 3: Barnyard and Snorby Configuration (Module 4)
Lab 4: Operating Snort (Module 5)
Lab 5: Configuring Your IDS/IPS Installation (Module 6)
Lab 6: Portscan Configuration (Module 7)
Lab 7: Stream Reassembly (Module 7)
Lab 8: Pulled Pork Installation, Configuration, and Usage (Module 8)
Lab 9: Building a Distributed Snort Installation (Module 9)
Lab 10: Wrighting Custom Rules (Module 10)
Lab 11: Building an Inline IPS (Module 11)
Lab 12: Using the Drop Action (Module 11)
Lab 13: Using the Replace Action (Module 11)
Lab 14: Optimizing Rules (Module 12)
Lab 15: Using and Testing PCRE in Rules (Module 13)
Lab 16: Using Event Filtering (Module 14)
Lab 17: Using Supression (Module 14)
Lab 18: Configuring Rule Profiling (Module 14)
Lab 19: Detecting SADMIND Trust with Byte_Jump and Byte_Test (Module 15)
Lab 20: Using the Bitwise AND Operation in Byte_Test (Module 15)
Lab 21: Detecting ZenWorks Directory Traversal with Byte_Extract (Module 15)
Lab 22: Writing Flowbits Rules (Module 16)
Lab 23: Research and Packet Analysis (Module 17)
Lab 24: Revisiting the Kaminsky Vulnerability (Module 17)

Related Topics