Re: General snort question

[Matt Kettler <mkettler () evi-inc com>]

At 03:31 PM 9/10/2004, Wendell Smith wrote:
> So I have just installed Snort/Acid on a test server of mine and for the
> most part, I'm really enjoying the functionality these two apps provide.
> I would like to deploy this IDS on my WAN exposed servers.
>
> My question to the list is:
>
> Can I do this in a way such that I don't have to install Snort, Acid,
> Apache, PHP, MySQL, etc on each of these WAN exposed machines.

Do you really need or even want separate collections per server?
Are your wan exposed servers all in their own subnet (ie: all in one DMZ)?

In general I'd just use a managed switch for the DMZ, and configure a span 
port to monitor the link up to your firewall or router. Run the span to a 
snort box and sniff the whole subnet's internet traffic all at once.

If you've got a couple DMZs, you can add extra interfaces to your snort box 
and just run multiple instances of snort on the same machine, or use 
bonding to bond the interfaces and have a single snort use the bonded 
interface.





-------------------------------------------------------
This SF.Net email is sponsored by: YOU BE THE JUDGE. Be one of 170
Project Admins to receive an Apple iPod Mini FREE for your judgement on
who ports your project to Linux PPC the best. Sponsored by IBM. 
Deadline: Sept. 13. Go here: http://sf.net/ppc_contest.php
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users