Snort 3.0 SANS Paper

Here is a great SANS GCIA Gold paper for anyone interested in Snort 3.0. Doug also created a very nice bootable live cd with Snort 3.0, Sguil, and other tools from the 503 track. Check him out at http://securityonion.blogspot.com.

http://www.sans.org/reading_room/whitepapers/detection/snort_3_0_beta_3_for_analysts_33068