Snort mailing list archives
Re: Snort Enterprise Implementation
From: Jens Krabbenhoeft <tschenz-snort-users () noris net>
Date: Mon, 13 Jan 2003 15:58:01 +0100
Greg,
recorded for the fields TCP, UDP, ICMP of the Analysis Console for Intrusion Databases (ACID); however, the precent for Portscan Traffic remains at zero ACID.
You have to point ACID to your scan.log file in the config: /* Snort spp_portscan log file */ $portscan_file = ""; The problem is, that the portscan data isn't normalized into the database structure and remains in a plain file. I don't know if IDScenter is syncing files between the IDS box and the ACID box. If not, try to find a solution how to sync the portscan log onto the acid box (rsync, scp, ftp, ...). HTH, Jens ------------------------------------------------------- This SF.NET email is sponsored by: FREE SSL Guide from Thawte are you planning your Web Server Security? Click here to get a FREE Thawte SSL guide and find the answers to all your SSL security issues. http://ads.sourceforge.net/cgi-bin/redirect.pl?thaw0026en _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Snort Enterprise Implementation Greg Adams (Jan 13)
- Re: Snort Enterprise Implementation Jens Krabbenhoeft (Jan 13)
- Re: Snort Enterprise Implementation Dustin Decker (Jan 13)
- <Possible follow-ups>
- Re: Snort Enterprise Implementation larc (Jan 13)
- RE: Snort Enterprise Implementation Hicks, John (Jan 13)