RE: double role box

["Morgan R. Elmore" <Morgan () SEEMAC COM>]

Saul,

The guide can be downloaded from http://www.superhac.com/snort

Use the guide.  I'm Linux challenged and had no problems setting up a box as
the SnortCenter console and as a SnortCenter agent using the above guide by
Steven Scott.  

To answer your question about adding the sensor in SnortCenter...
eth0 should be configured with an IP address
eth1 should NOT be configured, just enabled

SENSOR IP=address of eth0
Port#=2525

Interface name to sniff=eth1

It's all on page 20.


-----Original Message-----
From: Erick Mechler [mailto:emechler () techometer net]
Sent: Wednesday, January 15, 2003 4:41 PM
To: Saúl Bósquez
Cc: Snort User Groups
Subject: Re: [Snort-users] double role box


:: I'm using the database box as a sensor, I finished the first phase
database
:: configuration...
:: and I started configuring phase II ...when adding the box as a sensor for
:: the snortcenter console, what IP/port  should i use as the sensor IP?

Saul, I'd be happy to come over there and fix all this for you.  My
consulting rates are about $110/hr.  It's becoming pretty apparent that you
can't figure this out on your own.  In fact, I'm questioning whether you
are actually reading any of the messages people on this list are sending
you.

Again, without fail, the answer to the question you're asking is IN THE 
DOCUMENTATION.

  http://www.snort.org/docs/writing_rules/chap2.html#tth_sEc2.5.8

See the section where it describes the "host" parameter?

Saul, seriously, read the docs.  They have the answers.  You haven't asked 
a single question on this list that hasn't been answered in the appropriate 
documentation.




-------------------------------------------------------
This SF.NET email is sponsored by: A Thawte Code Signing Certificate 
is essential in establishing user confidence by providing assurance of 
authenticity and code integrity. Download our Free Code Signing guide:
http://ads.sourceforge.net/cgi-bin/redirect.pl?thaw0028en
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users



-------------------------------------------------------
This SF.NET email is sponsored by: A Thawte Code Signing Certificate
is essential in establishing user confidence by providing assurance of
authenticity and code integrity. Download our Free Code Signing guide:
http://ads.sourceforge.net/cgi-bin/redirect.pl?thaw0028en
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users