Network Intrusion Detection (3rd Edition) by Stephen Northcutt Judy Novak
The expert network security authors share their ongoing intrusion experience to help you prepare to meet your intrusion detection challenges with confidence. You’ll get complete coverage of key concepts such as how packets really work on the network, how to determine if a network trace is a stimulus or response, how to analyze traffic and information contained in IP and higher protocol fields, how to identify intrusions by the signature of the intruder, and how to incorporate intrusion detection into standard business setups.