Building Simple IDS Agents

Go to www.snort.org for a great intrusion detection agent for Linux. The best part is it's free.
Also follow this link:

http://www.nswc.navy.mil/ISSEC/CID/id_secure.mdb

for a GREAT Access database put together by Gregory Stocksdale that compares IDSs, many of which are free.

Step by Step instructions for tcpdump at: http://www.nswc.navy.mil/ISSEC/CID/step.htm

And of course the following sites:
www.securityfocus.com
www.sans.org
Hope this helps, MB

You didn't mention the platform you planned on using, so I thought I'd put my two cents in for Unix. I use Linux too, but I have a preference for the Sun processor.

Mbrvo gave you some excellent references, especially www.sans.org and securityfocus. I recommend it highly.

I used this specific document, written by Lance Spitzner (he's involved with SANS also), to build an IDS.
http://secinf.net/info/unix/lance/ids.html

If you want more information on the subject, the Network Security Library has several really good articles.
http://secinf.net/iidse.html

Good luck!!!
Melissa

Building the Perfect IDS:

http://archives.neohapsis.com/archives/sf/ids/2001-q3/0051.html

(REMOVE SPAES from the pasted URL.)

Implementing a proactive IDS model - basically, scanning the network for vulnerabilities, and watching the IDS logs, firewall logs, syslogs, event viewer logs, and any other application logs to correlate the events and see how the different applications and security tools on the network react to intrusion attempts.

Combining network and host-based IDS. Combining the info on the network sensors and the host-based sensors will provide more will provide a more reliable model. If a network IDS sees a particular event, it should communicate that to the host based IDS. In return, the host based IDS
informs the network based IDS of all activity that it is seeing and the actions that it is taking.

Use of Network Node IDS. This takes care of problems with encrypted networks, switched networks, and high-speed networks.

----------

See the link for the whole article.

Maxwell