RE: learning snort

["Andre' M. DiMino" <tsamp77 () optonline net>]

Hi Jim...

One thing you may consider in a limited lab setup is the use of VMWare.  For
example, you can setup a linux guest running Snort, and another linux guest
(or the host) running Nessus or Hping.  Why not shoot the works and have
another guest act as a syslog server as well :)

HTH
Andre'
Semper_Securus

 

-----Original Message-----
From: snort-users-admin () lists sourceforge net
[mailto:snort-users-admin () lists sourceforge net] On Behalf Of James B
Horwath
Sent: Wednesday, September 28, 2005 3:46 PM
To: snort-users () lists sourceforge net
Subject: [Snort-users] learning snort

I am in the process of studying for the GCIA second exam which covers snort
setup and use.  I have been reading the mailing list, snort documentation
and playing with a small controlled snort setup. Although RTFM is great, I
learn better by actually doing hands on things.  I am using a packet
crafting tool like hping2 to watch and learn how snort works.  I have been
reading about tools like snot which use the snort configuration and build
packets based on the configuration.  This seems like an ideal way to learn
more about snort behavior. I am having trouble finding snot, are there any
other tools recommended to exercise snort and learn the what, why's and how.
I don't have access to any large network to  try a live implementation, so
my small and humble lab is the best I can do.  Any recommendations I would
really appreciate.

Regards,
Jim


-----------------------------------------
This message, and any attachments to it, may contain information that is
privileged, confidential, and exempt from disclosure under applicable law.
If the reader of this message is not the intended recipient, you are
notified that any use, dissemination, distribution, copying, or
communication of this message is strictly prohibited.  If you have received
this message in error, please notify the sender immediately by return e-mail
and delete the message and any attachments.  Thank you.



-------------------------------------------------------
This SF.Net email is sponsored by:
Power Architecture Resource Center: Free content, downloads, discussions,
and more. http://solutions.newsforge.com/ibmarch.tmpl
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users




-------------------------------------------------------
This SF.Net email is sponsored by:
Power Architecture Resource Center: Free content, downloads, discussions,
and more. http://solutions.newsforge.com/ibmarch.tmpl
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users