Re: barnyard (Payload)

[Alwin Raymundo <alrayworld () yahoo com>]

Hi Marty,

Sorry I'm busy this week and I just open my email.

in my snort.conf 
output aler_unified: filename snort.alert, limit 128

in barnyard.conf
config hostname: snorthost
config interface: fxp0
config filter: not port 22
processor dp_alert
processor dp_log
processor dp_stream_stat
output alert_fast
output log_dump
output alert_acid_db: mysql, sensor_id 1, database
snort, server localhost, user usnort, password loghog

I'm new with barnyard. Thanks in Advance for your
help.

Your brother in snort

Alwin
--- Martin Roesch <roesch () sourcefire com> wrote:
> Which unified output option are you guys using?
>
>       -Marty
>
>
> On 10/1/02 8:57 AM, "Alwin Raymundo"
> <alrayworld () yahoo com> wrote:
>
> > Hi Ron,
> >
> > Yap to me the payload is very important.  for my
> own
> > opinion.  we know that somebody trying to do some
> > nasty thing to our server but how?
> >
> > without the payload its look like I shooting in
> the
> > dark.
> >
> > Thanks
> >
> >
> > --- Ron Shuck <rshuck () Buchanan com> wrote:
> > > Hey Alwin,
> > >
> > > I found the same results. I haven't heard if
> there
> > > are plans to include
> > > this, or if it should work and we just missed
> > > something.
> > >
> > >
> > > Ron Shuck, CISSP - Managing Consultant
> > > Buchanan Associates - A Technology Company in the
> > > People Business
> > > http://www.buchanan.com
> > > http://www.isc2.org
> > >
> > >
> > > ---original message---
> > > Date: Mon, 30 Sep 2002 11:36:39 -0700 (PDT)
> > > From: Alwin Raymundo <alrayworld () yahoo com>
> > > To: user snort
> <snort-users () lists sourceforge net>
> > > Subject: [Snort-users] barnyard (Payload)
> > >
> > > Hi Everybody,
> > >
> > > I don't know if this is already posted in
> previous
> > > discussion and this morning I just setup the
> > > barnyard.
> > >  I like it because it fast to log all packets in
> my
> > > mysql and acid but I notice there is no payload.
> > >
> > > Is this normal? is there in another way to get
> the
> > > payload?.
> > >
> > > Any help would be appreciated.
> > >
> > > Thanks in advance.
> >
> > > ATTACHMENT part 2 application/x-pkcs7-signature
> > name=smime.p7s
> >
> >
> >
> > =====
> > Alwin Raymundo
> >
> > __________________________________________________
> > Do you Yahoo!?
> > New DSL Internet Access from SBC & Yahoo!
> > http://sbc.yahoo.com
-------------------------------------------------------
> > This sf.net email is sponsored by: DEDICATED
> SERVERS only $89!
> > Linux or FreeBSD, FREE setup, FAST network. Get
> your own server
> > today at http://www.ServePath.com/indexfm.htm
> > _______________________________________________
> > Snort-users mailing list
> > Snort-users () lists sourceforge net
> > Go to this URL to change user options or
> unsubscribe:
> >
https://lists.sourceforge.net/lists/listinfo/snort-users
> > Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
> >
>
> -- 
> Martin Roesch - Founder/CTO Sourcefire Inc. - (410)
> 290-1616
> Sourcefire: Professional Snort Sensor and Management
> Console appliances
> roesch () sourcefire com - http://www.sourcefire.com
> Snort: Open Source Network IDS -
> http://www.snort.org
-------------------------------------------------------
> This sf.net email is sponsored by: DEDICATED SERVERS
> only $89!
> Linux or FreeBSD, FREE setup, FAST network. Get your
> own server 
> today at http://www.ServePath.com/indexfm.htm
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or
> unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users


=====
Alwin Raymundo

__________________________________________________
Do you Yahoo!?
New DSL Internet Access from SBC & Yahoo!
http://sbc.yahoo.com


-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users