ATTACK DETECTION A N D RESPONSE W I T H
I P T A B L E S , P S A D , A N D F W S N O R T MICHAEL R ASH
Linux Firewalls is a great book.
— From the foreword by Richard Bejtlich of TaoSecurity.com
LINUX FIRE WALLS
Attack Detection and Response with iptables, psad, and fwsnort
by Mi cha el R as h
LINUX FIREWALLS. Copyright © 2007 by Michael Rash. All rights reserved. No part of this work may be reproduced or transmitted in any form or by any means, electronic or mechanical, including photocopying, recording, or by any information storage or retrieval system, without the prior written permission of the copyright owner and the publisher. Printed on recycled paper in the United States of America 11 10 09 08 07 123456789
ISBN-10: 1-59327-141-7 ISBN-13: 978-1-59327-141-1 Publisher: William Pollock Production Editor: Christina Samuell Cover and Interior Design: Octopod Studios Developmental Editor: William Pollock Technical Reviewer: Pablo Neira Ayuso Copyeditors: Megan Dunchak and Bonnie Granat Compositors: Christina Samuell and Riley Hoffman Proofreaders: Karol Jurado and Riley Hoffman Indexer: Nancy Guenther For information on book distributors or translations, please contact No Starch Press, Inc. directly: No Starch Press, Inc. 555 De Haro Street, Suite 250, San Francisco, CA 94107 phone: 415.863.9900; fax: 415.863.9950; firstname.lastname@example.org; www.nostarch.com Librar y of Congress Cataloging-in-Publication Data Rash, Michael. Linux firewalls : attack detection and response with iptables, psad, and fwsnort / Michael Rash. p. cm. Includes index. ISBN-13: 978-1-59327-141-1 ISBN-10: 1-59327-141-7 1. Computers--Access control. 2. Firewalls (Computer security) 3. Linux. I. Title. QA76.9.A25R36 2007 005.8--dc22 2006026679 No Starch Press and the No Starch Press logo are registered trademarks of No Starch Press, Inc. Other product and company names mentioned herein may be the trademarks of their...