Detecting Network Intrusions with Packet Filtering (O'Reilly)

[Posted July 28, 2004 by cook]

Don Parker explains packet filtering techniques on O'Reilly. "In an effort to put the usage of these filters into context I will explain a normal day in the life of a network security analyst. This day will focus on the usage of building and further explaining some complex examples. To clarify our example, I assume that the make-believe network has all packets that are flagged by the intrusion detection system logged to a central database. I mention this stipulation because not every real network operates in this fashion."