RE: General snort question

[Wendell Smith <wendels () castlebranch com>]

Let me preface this by apologizing for this potentially redundant
question.

I realize that I should most likely be using snort sensors to accomplish
the task I spoke of earlier in this thread. 

Where can I find documentation on how to accomplish this. I only found
one reference to the word "sensor" in the entire Snort manual. I grep
for "sensor" in the install/doc dir and I find only two instances of the
word. Neither of which sheds any light on how to make use of this
mechanism.

So...

Could someone point me in the direction of some documentation about
utilizing and deploying snort sensors that relay information to a
central back-end server?

Thanks and regards,

Wendell

> On Fri, 2004-09-10 at 15:39, McCash, John wrote:
> > Wendell,
> >     You only need all of those things on your back end database
> > server. The sensors (as I recall) will require mysql to be installed,
> > because the snort binary references the mysql library (unless you link
> > it statically). You don't need an actual database installed on the
> > sensor though. Just configure the database output plugins on all of your
> > sensors to report to the database on your database/web server, and
> > you're good to go. You don't have to run the database and the web
> > servers on the same machine either, if you don't want to.
> >             John McCash
> >
> > -----Original Message-----
> > From: snort-users-admin () lists sourceforge net
> > [mailto:snort-users-admin () lists sourceforge net] On Behalf Of Wendell
> > Smith
> > Sent: Friday, September 10, 2004 2:31 PM
> > To: snort-users () lists sourceforge net
> > Subject: [Snort-users] General snort question
> >
> > Hey all!
> >
> > So I have just installed Snort/Acid on a test server of mine and for the
> > most part, I'm really enjoying the functionality these two apps provide.
> > I would like to deploy this IDS on my WAN exposed servers. 
> >
> > My question to the list is:
> >
> > Can I do this in a way such that I don't have to install Snort, Acid,
> > Apache, PHP, MySQL, etc on each of these WAN exposed machines.
> >
> > I saw that logsnorter provides a way to do this but that it is no longer
> > supported. I have also read a little something about ethertaps but would
> > rather not recompile the kernels of 5-8 machines.
> >
> > Thanks and regards,
> >
> > Wendell Smith
> >
> >
> >
> > -------------------------------------------------------
> > This SF.Net email is sponsored by: YOU BE THE JUDGE. Be one of 170
> > Project Admins to receive an Apple iPod Mini FREE for your judgement on
> > who ports your project to Linux PPC the best. Sponsored by IBM. 
> > Deadline: Sept. 13. Go here: http://sf.net/ppc_contest.php
> > _______________________________________________
> > Snort-users mailing list
> > Snort-users () lists sourceforge net
> > Go to this URL to change user options or unsubscribe:
> > https://lists.sourceforge.net/lists/listinfo/snort-users
> > Snort-users list archive:
> > http://www.geocrawler.com/redir-sf.php3?list=snort-users
> >
> > ------------------------------------------------------------------------------------------------
> > This message is for the designated recipient only and may
> > contain privileged, proprietary, or otherwise private information.  
> > If you have received it in error, please notify the sender
> > immediately and delete the original.  Any unauthorized use of
> > this email is prohibited.
> > ------------------------------------------------------------------------------------------------
> > [mf2]





-------------------------------------------------------
This SF.Net email is sponsored by: YOU BE THE JUDGE. Be one of 170
Project Admins to receive an Apple iPod Mini FREE for your judgement on
who ports your project to Linux PPC the best. Sponsored by IBM. 
Deadline: Sept. 13. Go here: http://sf.net/ppc_contest.php
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users