About the Authors

Stephen Northcutt is a graduate of Mary Washington College. Before entering the field of computer security, he worked as a Navy helicopter search and rescue crewman, white water raft guide, chef, martial arts instructor, cartographer, and network designer. Stephen is author/coauthor of Incident Handling Step by Step, Intrusion Signatures and Analysis, Inside Network Perimeter Security, and the previous two editions of this book. He was the original author of the Shadow intrusion detection system and leader of the Department of Defense's Shadow Intrusion Detection team before accepting the position of Chief for Information Warfare at the Ballistic Missile Defense Organization. Stephen currently serves as Director of Training and Certification for the SANS Institute.

Judy Novak is currently a senior security analyst working for the Baltimore-based consulting firm of Jacob and Sundstrom, Inc. She primarily works at the Johns Hopkins University Applied Physics Laboratory where she is involved in intrusion detection and traffic monitoring and Information Operations research. Judy was one of the founding members of the Army Research Labs Computer Incident Response Team where she worked for three years. She has contributed to the development of a SANS course in TCP/IP and written a SANS hands-on course, "Network Traffic Analysis Using tcpdump," both of which are used in SANS certifications tracks. Judy is a graduate of the University of Maryland—home of the 2002 NCAA basketball champions. She is an aging, yet still passionate, bicyclist, and Lance Armstrong is her modern-day hero!

About the Technical Reviewers

These reviewers contributed their considerable hands-on expertise to the entire development process for Network Intrusion Detection, Third Edition. As the book was being written, these dedicated professionals reviewed all the material for technical content, organization, and flow. Their feedback was critical to ensuring that Network Intrusion Detection, Third Edition fits our readers' need for the highest-quality technical information.

Karen Kent Frederick is a senior security engineer for the Rapid Response team at NFR Security. She is completing her master's degree in computer science, focusing in network security, from the University of Idaho's Engineering Outreach program. Karen has over 10 years of experience in technical support, system administration, and security. She holds several certifications, including the SANS GSEC, GCIA, GCUX, and GCIH. Karen is one of the authors of Intrusion Signatures and Analysis and

Inside Network Perimeter Security: The Definitive Guide to Firewalls, VPNs, Routers, and Intrusion Detection Systems. Karen also frequently writes articles on intrusion detection for SecurityFocus.com.

David Heinbuch joined the Johns Hopkins University Applied Physics Laboratory in 1998. He has experience in intrusion detection, modeling and simulation, vulnerability assessment, and software development. As a member of the Information Operations group, he works on programs in various areas, including secure computing systems, attack modeling and analysis, and intrusion detection. Mr. Heinbuch has a bachelor of science in computer engineering from Virginia Tech and an master's of science in computer science from the Whiting School of Engineering, Johns Hopkins University.

Acknowledgments

Stephen Northcutt: The network detects and analytical insights that fill the pages of this book are contributions from many analysts all over the world. You and I owe them a debt of thanks; they have given us a great gift in making what was once mysterious, a known pattern.

I thank everyone who has served on, or contributed to, the Incidents.org team. You have found many new patterns, helped minimize the damage from a number of compromised systems, and even managed to teach a bit of intrusion detection along the way. Good work!

Incident handlers would be of little purpose if people weren't reporting attacks. The folks who contribute data to dshield.org are making a real difference. You showed that it was possible to share attack information and analysis and that bit by bit we would get smarter, better able to understand exploits and probes.

Judy Novak, thank you for working with me on this project. Your efforts and knowledge are the reason for the book's success. I truly appreciate the work our technical editors, Karen Kent Frederick and David Heinbuch, have done to catch the errors that can creep in while you are working late into the night, or from an airplane. Suzanne Pettypiece, thank you for your patience and organization in the busiest months of my entire life. A big thanks to Linda Bump for working with us to keep the project on schedule!

I want to take this opportunity to express my appreciation to Alan and Marsha Paller for friendship, support, encouragement, and guidance.

Kathy and Hunter, thank you again for the love and support in a writing cycle. Kathy, I especially thank you for being willing to quit your job to help me keep all the plates spinning. I love you.

"But if any of you lacks wisdom, let him ask of God, who gives to all men generously and without reproach, and it will be given to him." James 1:5

Any wisdom or understanding I have is a gift from the Lord Jesus Christ, God the All Mighty, and the credit should be given to Him, not to me.

I hope you enjoy the book and it serves you well!

Judy Novak: Many thanks to Stephen Northcutt for his tireless efforts in educating the world about security and encouraging me to join him in his efforts. His guidance has literally changed my life and the rewards and opportunities from his influence have been plentiful. While the words to express my thanks seem anemic, the gratitude is truly heartfelt.

I'd like to thank the wonderfully wise technical editors David Heinbuch and Karen Kent Frederick for their patient and astute feedback. They are the blessed souls who save me from total embarrassment! Also, I'd like to extend special thanks to Paul Ritchey, who edited the Snort chapters for technical accuracy. He whipped out the feedback with speed and insight.

Finally, last, but never least, I'd like to thank my family—Bob and Jesse—for leaving me alone long enough when I needed to work on the book, but gently nudging me to take a break when atrophy set in. There is real danger in being left alone too long!