We are happy to advise you!
+49 40 253346-10     Contact

Online training in the virtual classroom
E-Learning offers and more

Find out more

Securing Cisco Networks with Open Source Snort (SSFSNORT)

 

Course Overview

Securing Cisco® Networks with Open Source Snort™ is an instructor-led course offered by Learning Services High-Touch Delivery. It is a lab-intensive course that introduces students to the open source Snort technology as well as rule writing. You will learn how to build and manage a Snort system using open source tools, plug-ins, and the Snort rule language to help manage, tune, and deliver feedback on suspicious network activity. This course combines lecture materials and hands-on labs throughout to make sure that you are able to construct a solid, secure Snort installation and write Snort rules using proper syntax and structure.

This course combines lecture materials and hands-on labs throughout to make sure that you are able to construct a solid, secure Snort installation and write Snort rules using proper syntax and structure.

This is a Cisco Learning Services course and is delivered directly by Cisco.

Who should attend

This course is designed for technical professionals who need to know how to deploy open source intrusion detection systems (IDS) and intrusion prevention systems (IPS), as well as write Snort rules. The primary audience for this course includes:

  • Security administrators
  • Security consultants
  • Network administrators
  • System engineers
  • Technical support personnel using open source IDS and IPS
  • Channel partners and resellers

Prerequisites

  • Technical understanding of TCP/IP networking and network architecture
  • Proficiency with Linux and UNIX text editing tools (vi editor is suggested but not required)

Course Objectives

Upon completion of this course, you should be able to:

  • Understand what Snort is and its basic architectural components
  • Understand Snort’s dynamic plug-in capapbilities
  • Understand the different modes of Snort operation
  • Perform installation and configuration of the Snort system
  • Install and configure Snorby
  • Configure and tune the Snort pre-processors
  • Understand rule maintenance and techniques to keep rules current
  • Create Snort rules using both simple and advanced rule-writing techniques
  • Monitor performance of a Snort deployment

Course Content

Course Outline

  • Module 1: Intrusion Sensing technology, Challenges, and Sensor Deployment
  • Module 2: Introduction to Snort Technology
  • Module 3: Snort Installation
  • Module 4: Cofiguring Snort for Database Output and Graphical Analaysis
  • Module 5: Operating Snort
  • Module 6: Snort Configuration
  • Module 7: Configuring Snort Preprossors
  • Module 8: Keeping Rules Up to Date
  • Module 9: Budilidng a Distributed Snort Instalation
  • Module 10: Basic Rule Syntax and Usage
  • Module 11: Buildling a Snort IPS Installation
  • Module 12: Rule Optimization
  • Module 13: Using PCRE in Rules
  • Module 14: Basic Snort Tuning
  • Module 15: Using Byte_Jump/Test/Extract Rule Options
  • Module 16: Protocol Modeling Concepts and Using Flowbits in Rule Writing
  • Module 17: Case Studies in Rule Writing and Packet Analysis

Lab Outline

  • Lab 1: Install Snort and Its Components (Module 3)
  • Lab 2: Barnyard2 Installation (Module 4)
  • Lab 3: Barnyard and Snorby Configuration (Module 4)
  • Lab 4: Operating Snort (Module 5)
  • Lab 5: Configuring Your IDS/IPS Installation (Module 6)
  • Lab 6: Portscan Configuration (Module 7)
  • Lab 7: Stream Reassembly (Module 7)
  • Lab 8: Pulled Pork Installation, Configuration, and Usage (Module 8)
  • Lab 9: Building a Distributed Snort Installation (Module 9)
  • Lab 10: Wrighting Custom Rules (Module 10)
  • Lab 11: Building an Inline IPS (Module 11)
  • Lab 12: Using the Drop Action (Module 11)
  • Lab 13: Using the Replace Action (Module 11)
  • Lab 14: Optimizing Rules (Module 12)
  • Lab 15: Using and Testing PCRE in Rules (Module 13)
  • Lab 16: Using Event Filtering (Module 14)
  • Lab 17: Using Supression (Module 14)
  • Lab 18: Configuring Rule Profiling (Module 14)
  • Lab 19: Detecting SADMIND Trust with Byte_Jump and Byte_Test (Module 15)
  • Lab 20: Using the Bitwise AND Operation in Byte_Test (Module 15)
  • Lab 21: Detecting ZenWorks Directory Traversal with Byte_Extract (Module 15)
  • Lab 22: Writing Flowbits Rules (Module 16)
  • Lab 23: Research and Packet Analysis (Module 17)
  • Lab 24: Revisiting the Kaminsky Vulnerability (Module 17)
Online Training

Duration 4 days

Digital courseware

Courseware language: English

Classroom Training

Duration 4 days

Price (excl. tax)
  • Germany: US$ 4,000.-
  • Switzerland: US$ 4,000.-
  • Cisco Learning Credits: 40 CLC
Digital courseware

Courseware language: English

E-Learning Cisco Digital Learning

Duration 180 days

Price (excl. tax)
  • Germany: 1,000.- €
  • Switzerland: US$ 1,000.-
Fast Lane Live Buy E-Learning

Schedule

This computer icon in the schedule indicates that this date/time will be conducted as Instructor-Led Online Training.
This is a FLEX course, which is delivered both virtually and in the classroom. All FLEX courses are also Instructor-led Online Trainings (ILO).
English
Time zone CEST
02/11/2020 ― 05/11/2020 Online Training Time zone: CET
1 hour difference
13/10/2020 ― 16/10/2020 Online Training Time zone: BST
16/11/2020 ― 19/11/2020 Online Training Time zone: GMT
09/02/2021 ― 12/02/2021 Online Training This is an English language FLEX course.
Time zone: GMT
06/04/2021 ― 09/04/2021 Online Training This is an English language FLEX course.
Time zone: BST
22/06/2021 ― 25/06/2021 Online Training This is an English language FLEX course.
Time zone: BST
7 hours difference
15/12/2020 ― 18/12/2020 Online Training Time zone: CST
8 hours difference
22/09/2020 ― 25/09/2020 Online Training Time zone: MDT
This is a FLEX course, which is delivered both virtually and in the classroom. All FLEX courses are also Instructor-led Online Trainings (ILO).
Germany

Currently no local training dates available.  For enquiries please write to info@flane.de.

FLEX & Online Training

Please see below our alternative, English language, FLEX course options.

09/02/2021 ― 12/02/2021 London, City This is an English language FLEX course.
Time zone: GMT