 network transparency, resource allocation, and problem partitioning. The application layer is concerned with the user's view of the network, like formatting. In addition, this layer allows access to services that support applications and handle network access, flow, and recovery.
DNS, FTP, TFTP, BOOTP, SNMP, RLOGIN, SMTP, MIME, NFS, FINGER, TELNET, APPC, AFP,
The presentation layer helps to translate between the application and the network formats. This is also where protocol conversion takes place.
Named Pipes, Mail Slots, RPC, NCP, SMB
The session layer helps to establish, maintain, and end sessions across the network.
Transport (packets; flow control and error-handling)
The transport layer manages the flow control of data between parties across the network.
TCP, ARP, RARP, SPX, NWLink, ATP, NetBEUI
Network (addressing; routing)
The network layer translates logical network addresses and names to their physical addresses and is responsible for addressing and managing network problems such as packet switching, data congestion, and routing.
IP, ARP, RARP,
Data link (data frames to bits)
The data-link layer turns packets into raw bits on the sending end, and at the receiving end turns bits into packets. It handles data frames between the network and physical layers.
Physical (hardware; raw bit stream)
The physical layer transmits the raw bit stream over the physical cable or airwaves (when dealing with wireless). It defines cables, cards, and other physical aspects.
IEEE 802, IEEE 802.2, ISO 2110, ISDN
IDSs fall into one of three categories: host-based intrusion-detection system (HIDS), network-based intrusion-detection system (NIDS), and hybrids of the two.
A HIDS system will require some software that resides on the system and can scan all host resources for activity; some just scan syslog and event logs for activity. It will log any activities it discovers to a secure database and check to see whether the events match any malicious event record listed in the knowledge base.
A NIDS system is usually inline on the network, and it analyzes network packets looking for attacks. A NIDS receives all packets on a particular network segment, including switched networks (where this is not the default behavior) via one of several methods, such as taps or port mirroring. It carefully reconstructs the streams of traffic to analyze them for patterns of malicious behavior. Most NIDSs are equipped with facilities to log their activities and report or alarm on questionable events. In addition, many high-performance routers offer NID capabilities.
A hybrid IDS combines a HIDS, which monitors events occurring on the host system, with a NIDS, which monitors network traffic. Table 1-2 shows some of the differences between a HIDS and a NIDS.
Broad in scope (watches all network activities)
Narrow in scope (watches only specific host activities)
More complex setup
Better for detecting attacks from the outside
Better for detecting attacks from the inside
Less expensive to implement
More expensive to implement
Detection is based on what can be recorded on the entire network
Detection is based on what any single host can record
Examines packet headers
Does not see packet headers
Near real-time response
Usually only responds after a suspicious log entry has been made
Detects network attacks as payload is analyzed
Detects local attacks before they hit the network
Detects unsuccessful attack attempts
Verifies success or failure of attacks
The basic process for an IDS is that a NIDS or HIDS passively collects data and preprocesses and classifies them. Statistical analysis can be done to determine whether the information falls outside normal activity, and if so, it is then matched against a knowledge base. If a match is found, an alert is sent. Figure 1-2 outlines this activity.
Figure 1-2: Standard IDS system
It is still early in the development of intrusion-prevention systems (IPSs), but generally an IPS sits inline on the network and monitors it, and when an event occurs, it takes action based on prescribed rules. This is unlike IDSs, which do not