Copyright

Copyright © 2003 by New Riders Publishing

THIRD EDITION: September 2002

All rights reserved. No part of this book may be reproduced or transmitted in any form or by any means, electronic or mechanical, including photocopying, recording, or by any information storage and retrieval system, without written permission from the publisher, except for the inclusion of brief quotations in a review.

Library of Congress Catalog Card Number: 2001099565

06 05 04 03 02 7 6 5 4 3 2 1

Interpretation of the printing code: The rightmost double-digit number is the year of the book's printing; the rightmost single-digit number is the number of the book's printing. For example, the printing code 02-1 shows that the first printing of the book occurred in 2002.

Printed in the United States of America

Trademarks

All terms mentioned in this book that are known to be trademarks or service marks have been appropriately capitalized. New Riders Publishing cannot attest to the accuracy of this information. Use of a term in this book should not be regarded as affecting the validity of any trademark or service mark.

Warning and Disclaimer

This book is designed to provide information about intrusion detection. Every effort has been made to make this book as complete and as accurate as possible, but no warranty of fitness is implied.

The information is provided on an as-is basis. The authors and New Riders Publishing shall have neither liability nor responsibility to any person or entity with respect to any loss or damages arising from the information

contained in this book or from the use of the discs or programs that may accompany it.

Credits

Publisher

David Dwyer

Associate Publisher

Stephanie Wall

Production Manager

Gina Kanouse

Managing Editor

Kristy Knoop

Senior Acquisitions Editor

Linda Anne Bump

Senior Marketing Manager

Tammy Detrich

Publicity Manager

Susan Nixon

Project Editor

Suzanne Pettypiece

Copy Editor

Kelli Brooks

Indexer

Larry Sweazy

Manufacturing Coordinator

Jim Conway

Book Designer

Louisa Klucznik

Cover Designer

Brainstorm Design, Inc.

Cover Production

Aren Howell

Proofreader

Beth Trudell

Composition

Gloria Schurick

Dedication

Network Intrusion Detection, Third Edition is dedicated to Dr. Richard Stevens

Stephen Northcutt: I can still see him in my mind quite clearly at lunch in the speaker's room at SANS conferences—long blond hair, ponytail, the slightly fried look of someone who gives his all for his students. I remember the scores from his comment forms. Richard Stevens was the

best instructor of us all. I know he is gone and yet, every couple days, I reach for his book TCP/IP Illustrated, Volume 1, usually to glance at the packet headers inside the front cover. I am so thankful to own that book; it helps me understand IP and TCP, the network protocols that drive our world. In three weeks or so, I will teach TCP to some four hundred students. I am so scared. I cannot fill his shoes, not even close, but the knowledge must continue to be passed on. I can't stress "must" enough; there is no magic product that can do intrusion detection for you. In the end, every analyst needs a basic understanding of how IP works so they will be able to detect the anomalies. That was the gift Dr. Stevens left each of us. This book builds upon that foundation!

Judy Novak: Of all the influences in the field of security and traffic analysis, none has been more profound than that of the late Dr. Richard Stevens. He was a prolific and accomplished author. The book I'm most familiar with is my dog-eared, garlic saucestained copy of TCP/IP Illustrated, Volume 1. It is an absolute masterpiece because he is the ultimate authority on TCP/IP and Unix, and he had the rare ability to make the subjects coherent. I know several of the instructors at SANS consider this work to be the "bible" of TCP/IP. I once had the opportunity to be a student in a course he taught for SANS, and I think I sat with mouth agape in reverence of someone with such knowledge. Last summer, he agreed to edit a course I had written for SANS in elementary TCP/IP concepts. This was the equivalent of having Shakespeare critically review a grocery list. I carry his book with me everywhere, and I will not soon forget him.