Snort mailing list archives
Re: ACID with multiple Sensors?
From: Sean Brown <sblinux () shaw ca>
Date: Mon, 27 Sep 2004 12:13:46 -0600
On September 27, 2004 7:25 am, Bill Warren wrote:
All, I just got ACID, PHP, MySQL installed on my Snort box. Then hit it hard with Nessus to make sure that it works and it does. When I was reading the results I saw that I could search multiple senors. So, my question is how do I make multiple Snort boxes talk to each other? Thanks, Bill
I have snort running on a firewall, I configured 2 instances, on listening on the internal interface and one on the external, they use different .conf files so it would be the same as if they were on separate machines. Here is the mysql line from each: External: output database: log,mysql,dbname=snort user=snorter host=192.168.1.2 port=3306 sensor_name=SPARTA_FW_EXT Internal: output database: log,mysql,dbname=snort user=snorter host=192.168.1.2 port=3306 sensor_name=SPARTA_FW_INT As you can see all you have to do is point them at the same database and assign each one a unique name, with the aptly named sensor_name. -Sean Brown ------------------------------------------------------- This SF.Net email is sponsored by: YOU BE THE JUDGE. Be one of 170 Project Admins to receive an Apple iPod Mini FREE for your judgement on who ports your project to Linux PPC the best. Sponsored by IBM. Deadline: Sept. 24. Go here: http://sf.net/ppc_contest.php _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- ACID with multiple Sensors? Bill Warren (Sep 27)
- Re: ACID with multiple Sensors? Sean Brown (Sep 27)
- <Possible follow-ups>
- RE: ACID with multiple Sensors? Gould, Scott (Sep 27)