Re: Remote NIDS

[Dirk Geschke <Dirk_Geschke () genua de>]

Hi Chris,

> I am looking for a method to have remote NIDS log alerts to a central
> SNORT/Acid box running MySQL and Redhat 9.0.
> Anyone have a link for docs on this or recommendations?

there are several solutions available:

1. The easiest is the database output plugin from snort. Look
   at the snort.conf how to activate it.

2. Barnyard (http://www.snort.org/dl/barnyard/), this program
   uses the unified output plugin and can forward the alerts
   direct to the TCP/IP interface of a central database.

3. Mudpit (http://www.fidelissec.com/mudpit.html), this is similar
   to barnyard and uses also the unified output plugin of snort.

4. FLoP (http://www.geschke-online.de/FLoP). This project uses
   a unix domain socket to get the alerts from snort, no local
   files are used. These alerts are forward to a central server
   where they are buffered and then feeded via a unix socket 
   into the database. This should be the fastest solution since
   there is less network traffic between the sensor and the central 
   server.

I would recommend point FLoP (I am the author of it... ;-))

Best regards

Dirk
--
+-------------------------------------------------------------+
| Dr. Dirk Geschke            | E-mail: geschke () genua de      |
| Gesellschaft fuer Netzwerk  | Tel.  : +49-(0)-89-991950-131 |
| und Unix Administration mbH | Fax   : +49-(0)-89-991950-999 |
| 85551 Kirchheim / Germany   | Domagkstrasse 7               |
+-------------------------------------------------------------+




-------------------------------------------------------
This SF.net email is sponsored by: IBM Linux Tutorials.
Become an expert in LINUX or just sharpen your skills.  Sign up for IBM's
Free Linux Tutorials.  Learn everything from the bash shell to sys admin.
Click now! http://ads.osdn.com/?ad_id78&alloc_id371&op=click
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users