Snort mailing list archives
RE: When did this change?
From: "Jeff Dell" <jdell () activeworx com>
Date: Sun, 27 Jun 2004 15:27:20 -0400
It hasn't changed.. Those additional tables were installed by Aanval Intrusion Detection Console. You must have installed it between May04 and now. Cheers, Jeff -----Original Message----- From: snort-users-admin () lists sourceforge net [mailto:snort-users-admin () lists sourceforge net] On Behalf Of Paul Schmehl Sent: Sunday, June 27, 2004 2:59 PM To: snort-users () lists sourceforge net Subject: [Snort-users] When did this change? I've been doing some updating on a snort box, and I had to troubleshoot some problems. While in the midst of that, I discovered something that shocked me. The schema for the database (mysql) has changed dramatically. (I'm running snort 2.1.2 on FreeBSD.) Here's the old schema: mysql> show tables; +-------------------------+ | Tables_in_archive_MAY04 | +-------------------------+ | data | | detail | | encoding | | event | | icmphdr | | iphdr | | opt | | reference | | reference_system | | schema | | sensor | | sig_class | | sig_reference | | signature | | tcphdr | | udphdr | +-------------------------+ 16 rows in set (0.00 sec) And here's the new schema: mysql> show tables; +--------------------+ | Tables_in_snort | +--------------------+ | acid_ag | | acid_ag_alert | | acid_event | | acid_ip_cache | | actions | | data | | detail | | encoding | | event | | flags | | frequent_offenders | | hostnames | | icmphdr | | ids_collection | | ids_live_track | | ids_logs | | ids_mark | | ids_oad_buffer | | ids_ops | | ids_sensors | | ids_track | | iphdr | | opt | | protocols | | reference | | reference_system | | schema | | sensor | | sig_class | | sig_reference | | signature | | tcphdr | | timezones | | udphdr | | users | +--------------------+ 35 rows in set (0.00 sec) When did the schema change? Obviously this changes things dramatically. Not the least my database archiving script. It also raises some questions. I've done some reading, and I understand these extra tables come from the snort_extra file in the contrib directory, but I'm wondering if anyone knows when FBSD started including these in the standard install. "frequent_offenders" - is this being used now? Or is it for the future? "users" - what is this for? "ids_..." - what are these for? Paul Schmehl (pauls () utdallas edu) Adjunct Information Security Officer The University of Texas at Dallas AVIEN Founding Member http://www.utdallas.edu ------------------------------------------------------- This SF.Net email sponsored by Black Hat Briefings & Training. Attend Black Hat Briefings & Training, Las Vegas July 24-29 - digital self defense, top technical experts, no vendor pitches, unmatched networking opportunities. Visit www.blackhat.com _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users ------------------------------------------------------- This SF.Net email sponsored by Black Hat Briefings & Training. Attend Black Hat Briefings & Training, Las Vegas July 24-29 - digital self defense, top technical experts, no vendor pitches, unmatched networking opportunities. Visit www.blackhat.com _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Announcement PigMail v. 1.01 Adam Ely (Jun 10)
- When did this change? Paul Schmehl (Jun 27)
- RE: When did this change? Jeff Dell (Jun 27)
- RE: When did this change? Paul Schmehl (Jun 27)
- RE: When did this change? Frank Knobbe (Jun 29)
- RE: When did this change? Jeff Dell (Jun 29)
- RE: When did this change? Jeff Dell (Jun 27)
- When did this change? Paul Schmehl (Jun 27)