Snort mailing list archives
RE: Snort and Mysql for statistics purposes
From: "Snort" <Snort () InterCept Net>
Date: Tue, 8 Mar 2005 23:11:12 -0500
That won't give you what you are looking for... you need ntop for that... http://www.ntop.org/ I run it on all my firewalls to do just what your looking for, except it doesn't do attacks. If your looking for network trends (top users, top websites, network load, top ports, etc etc) then ntop, if your looking for top attack data (ports, destination/src ip, etc etc,) then definitely use snort/mysql. Btw, ntop can also input to mysql.... then you get best of both worlds... Michael -----Original Message----- From: snort-users-admin () lists sourceforge net [mailto:snort-users-admin () lists sourceforge net] On Behalf Of David Jiménez Domínguez Posted At: Tuesday, March 08, 2005 7:05 PM Posted To: Snort Conversation: [Snort-users] Snort and Mysql for statistics purposes Subject: [Snort-users] Snort and Mysql for statistics purposes Hi folks! I need to graph all the traffic in my network (Top ports, Top src_ip, Top attacks) each 5 minutes...In the DataServer I have intalled Mysql and in the firewall I have installed snort-2.3.0 and I created just 4 rules to get all the tcp,udp,icmp and ip traffic in order to graph it with perl and rrdtool and post it in a web page.... Do you think it is the best way to do that??? Have your ever done something like that?? What tools do you recommend me?? Regards DJ -------------------------------------------------- ------------------------------------------------------- SF email is sponsored by - The IT Product Guide Read honest & candid reviews on hundreds of IT Products from real users. Discover which products truly live up to the hype. Start reading now. http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users ------------------------------------------------------- SF email is sponsored by - The IT Product Guide Read honest & candid reviews on hundreds of IT Products from real users. Discover which products truly live up to the hype. Start reading now. http://ads.osdn.com/?ad_ide95&alloc_id396&op=click _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Snort and Mysql for statistics purposes David Jiménez Domínguez (Mar 08)
- Re: Snort and Mysql for statistics purposes Jose Maria Lopez Hernandez (Mar 09)
- Re: Snort and Mysql for statistics purposes sushant (Mar 09)
- Re: Snort and Mysql for statistics purposes Muhammad Omar Khan (Mar 11)
- Re: Snort and Mysql for statistics purposes Olaf Gellert (Mar 09)
- Re: Snort and Mysql for statistics purposes David Jiménez Domínguez (Mar 09)
- Re: Re: Snort and Mysql for statistics purposes Alejandro Flores (Mar 10)
- <Possible follow-ups>
- RE: Snort and Mysql for statistics purposes Snort (Mar 08)
- RE: Snort and Mysql for statistics purposes Bénoni MARTIN (Mar 09)
- RE: Snort and Mysql for statistics purposes Stark, John (Mar 09)
- RE: Re: Snort and Mysql for statistics purposes Snort (Mar 14)
- RE: Snort and Mysql for statistics purposes Bénoni MARTIN (Mar 21)