Introduction

With the ever-growing popularity of the Internet and the increasing numbers of technical savvy (or not so savvy) people, your local area network (LAN) is constantly bombarded by unwanted traffic. Network security is a serious issue for Internet traffic toward your network, which is usually protected by various firewall architectures. The internal threat to network resources is, sometimes surprisingly, prevalent as well. You never know who in your company just read the latest article in "The Computer Security Bugle" and is, even as you read this, e-mailing a port-scanning tool to all of his friends. Snort is a remarkable tool for detecting wrongfully traversing packets on your network and responding with appropriate alerts, configured responses, and logging packet information for your review.

In today's world, no one has time to waste meticulously searching through pages of log files, especially searching for something that might not even be there. Snort's ability to use particular rules and set up specific alerts helps tremendously with this problem. With the selection of output plug-ins to choose from, Snort does a great job in allowing you to produce your output files in a pleasant format. However, a problem might arise: While Snort is busy with the resource-consuming process of writing packet captures to a human-readable database file, the network is still functioning as vigorously as usual.

As with any relentlessly run computer process, keeping up with such a fast pace creates a potential for errors, and Snort sensors might encounter problems with its real-time...