Questions about this topic? Sign up to ask in the talk tab.
Difference between revisions of "IDS"
From NetSec
WillieArce (Talk | contribs) m |
MargeryLeddy (Talk | contribs) |
||
| Line 15: | Line 15: | ||
[http://www.la-samhna.de/samhain/ Samhain] [[HIDS]] | [http://www.la-samhna.de/samhain/ Samhain] [[HIDS]] | ||
| − | Samhain - A file integrity checking application similar to OSSEC | + | Samhain - A file integrity checking [[applications|application]] similar to OSSEC |
[http://nepenthes.carnivore.it/Nepenthes Nepenthes] [[HIDS]] | [http://nepenthes.carnivore.it/Nepenthes Nepenthes] [[HIDS]] | ||
Revision as of 06:48, 13 September 2011
Intrusion Detection Systems
IDS are used to detect attacks aimed at a network or host. See Also: IPS, NIDS, and HIDS.
Tools:
Cisco IDS - A network layer intrusion detection system based off of tcpdump with signature support.
Snort - A network layer intrusion detection system based off of libpcap with signature support and preprocessor support.
OSSEC - A host-based intrusion detection system that utilizies log analysis combined with integrity checksums and rootkit detection engines.
Samhain - A file integrity checking application similar to OSSEC
Nepenthes - A malware connection utility similar to HoneyD
HoneyD - A tool for collecting malware and tricking attackers into thinking they've performed a successful attack.
