427 Botnet fm qxd

www.syngress.com
Botnet Detection: Tools and Techniques • Chapter 5
167
427_Botnet_05.qxd 1/9/07 9:59 AM Page 167

---

offer free versions of their software that use the same basic detection
engine and the same frequent updates but without interactive support
and some of the bells and whistles of the commercial version. Note
that these are normally intended for home use; for business use, you
are required to pay a subscription. Others, such as ESET and Frisk,
offer evaluation copies.These are usually time-restricted and might
not have all the functionality of the paid-for version.
■
Commercial AV products vary widely in their facilities and interfaces,
even comparing versions of a single product across platforms (and
some of the major vendors have a very wide range of products).
Furthermore, the speed of development in this area means that two
versions of the same product only a few months apart can look very
different. We don’t feel that detailed information on implementing
one or two packages would be very useful to you. It’s more impor-
tant to understand the concepts behind the technology so that you
can ask the right questions about specific products.
Snort as an Example IDS
Snort, written in 1998 by Martin Roesch, is often still described as a
lightweight NIDS, though its current capabilities compare very favorably to
heavyweight intrusion detection systems such as ISS RealSecure, Cisco’s
Secure IDS, eTrust IDS, and so on. Snort is available for most common plat-
forms, including Windows, Linux, BSD UNIX, Solaris, and Mac OS X.You
can get the software at a very attractive price—well, free (it’s open source, to
be precise). However, Sourcefire does market a commercial version (the
Sourcefire Intrusion Sensor), which is based on the Snort detection engine
but adds other components such as a friendlier interface, reporting, policy
management, and a full support package (www.sourcefire.com).
Snort is claimed at the time of writing to have well over 150,000 active
users and to have been downloaded over 3 million times (www.snort.org).
Although the superiority of open-source software, especially in the security
arena, is sometimes overstated, Snort is a fine example of how continuing
review and testing by a community of experienced programmers and admin-
istrators can benefit a product.