NIDS – psad and fwsnort

Posted on April 19, 2010 by bodhi.zazen

I have been playing with psad and fwsnort as a NIDS tool. They are light weight and very capable tools and I highly recommend both of them.

I was going to post a blog about these tools, but it kept growing longer and longer and involved init scripts, selinux policies, and apparmor profiles.

Rather then spamming the Ubuntu planet with all the details, I made a web page.

Nids – psad & fwsnort

Sorry this blog is brief, but the above link will get you started using psad / fwsnort on Debian (squeeze) , Fedora 13 , or Ubuntu 10.04.

Feel free to post any feedback or comments here.

This entry was posted in Linux and tagged . Bookmark the permalink.

2 Responses to NIDS – psad and fwsnort

  1. Seraphyn says:
    April 20, 2010 at 3:07 am

    There is something wrong in your Howto:
    Update psad signatures:
    psad –sid-update
    psad -H

    Should be psad –sig-update.
    Greetings
    Seraphyn

  2. bodhi.zazen says:
    April 20, 2010 at 9:33 am

    Thank you Seraphyn, fixed that.

Leave a Reply

Your email address will not be published. Required fields are marked *

*

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>