Snort mailing list archives
Re: Using snort as connection tracker
From: Jose Maria Lopez <jkerouac () bgsec com>
Date: 28 Dec 2004 23:43:17 +0100
El dom, 19 de 12 de 2004 a las 16:15, Klemen Mihevc escribiC3:
now i have a problem couse every packet is logged (and logs are huge) even if it's only about 1k big and it is product of outside scan of server not actual connection to it. Is there anyway to log only first and last package from 1 ip and only if data transfer is bigger then let's say 5k? Or maybe anyother way to log that connections? I also tryed with chaosreader & tcpdump but this method is too much cpu & ram consuming and i also tried with iptable but again with same problem (every package is logged). I relay wanna use snort because i can use mysql & acid for statistic...
I propose you two solutions: 1) Use just iptables (maybe this doesn't suit you because you want acid for the stats, storing the logs in mysql it's not a problem using ULOGD) and the connection tracking system. Use some general rules to accept the ESTABLISHED and RELATED traffic in the chains you want to use and then use a rule with --state NEW to log only the initial connections. 2) Use a mixed solution. You need almost the same iptables rules I have indicated above, but you can use snort-inline and the QUEUE feature of iptables to pass the packets to snort-inline. Then use the rules you have in snort-inline to just log the packets to mysql and then use Acid to see the results. Hope it helps. -- Jose Maria Lopez Hernandez Director Tecnico de bgSEC jkerouac () bgsec com bgSEC Seguridad y Consultoria de Sistemas Informaticos http://www.bgsec.com ESPAÑA The only people for me are the mad ones -- the ones who are mad to live, mad to talk, mad to be saved, desirous of everything at the same time, the ones who never yawn or say a commonplace thing, but burn, burn, burn like fabulous yellow Roman candles. -- Jack Kerouac, "On the Road" ------------------------------------------------------- SF email is sponsored by - The IT Product Guide Read honest & candid reviews on hundreds of IT Products from real users. Discover which products truly live up to the hype. Start reading now. http://productguide.itmanagersjournal.com/ _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Using snort as connection tracker Klemen Mihevc (Dec 19)
- Re: Using snort as connection tracker sekure (Dec 20)
- Re: Using snort as connection tracker Jose Maria Lopez (Dec 25)
- <Possible follow-ups>
- Re: Using snort as connection tracker Jose Maria Lopez (Dec 28)
- Re: Using snort as connection tracker Michael Boman (Dec 29)