(no subject)

[Peter Osterberg <Peter () sodapro se>]

Hi,

I've been using Snort for some time now with database logging. It's the 
Snort version that is used in PureSecure. I'm not quite sure how they 
differ, if they do. Demarc has told me that there are some differences 
between standard Snort and the PS version.
Anyway the problem I have is that reporting to the db is missed if some 
kind of network connection problem occurs between the sensor and the db.

Is there some well known and practised way around this problem? I've been 
thinking of logging traffic to disk using tcpdump and with a decent file 
split size, say 1 MB. Check if there are finished files every 5 minutes, 
check if there is a working connection with the db, process dump files, 
report alerts and exit. Hang around for five more minutes and repeat. I've 
noticed that the reported time for detected events is the timestamp when 
the alert is stored in the database and not the timestamp of the tcppacket 
that triggers the event. I guess that the SQL function "now()" is used in 
the query!?

Does anyone now if I can specify that "now()" shouldn't be used or some 
other way the reach my goals?

It just struck my mind that tcpdump most likely doesn't store timestamps 
for every packet in raw mode. Can I tell it to do so and will Snort be able 
to read it in case it is possible?

Sincerly
Peter Österberg



Soda Produktion
Peter Osterberg
Zenithgatan 36
212 14  Malmo
Tfn: 040 93 07 07
Mobil: 0709 - 49 49 69
Fax: 040 - 93 14 94
Peter.se
Webb: www.sodapro.se