Snort mailing list archives
Re: snort + mysql
From: Joel Esler <joel.esler () sourcefire com>
Date: Wed, 23 Apr 2008 16:12:33 -0400
Just for clairification, I said "dropped" because Lamanary said 'dropped', and in the context he's saying it in, dropped does not mean "dropped packets" as in the "engine can't handle the packet, so it drops it", it means the inline sense of the word, which inside Sourcefire we call "Blocked". Sourcefire shows you when a packet has been blocked or not. J JJ Cummings said:
A few things.. you are using the term "IPS", have you compiled snort inline and are thus running it inline, or using snortsam? If you simply want to know about "dropped" packets relative to processing stats... kill -USR1 <snortpidfoo> will dump that info for you. Yes, you can run squil and base together... but they are certainly different tools.... squil uses much more than just snort... as to guides i would suggest NSMwiki.org Once you get squil running you simply add the configuration to your by... no different than if you were dumping syslog and mysql with by.... JJC Joel Esler wrote: I am going to do my best to not plug Sourcefire. Sourcefire shows you when a packet has been dropped or not. Did I do okay? J Lamanary Ramos de Pina said: Hi all, I have a centos+snort+base ips set and is quite difficult to me to "see" the results of the drops on BASE console. I understand that a sdrop doesn't produce any alert but that's not what I want. Is there anything like BASE (free or not) that runs over snort that gives me a different feedback on the alerts, logs and drops namely? I read something about sguil and i would like to know if is possible to run it together with base? if yes, can you point me a good tutorial? Yes, I admit that I haven't googled enough on this yet, I'm just asking for a shotcut here. Thanks ------------------------------------------------------------------------- This SF.net email is sponsored by the 2008 JavaOne(SM) Conference Don't miss this year's exciting event. There's still time to save $100. Use priority code J8TL2D2. [1]http://ad.doubleclick.net/clk;198757673;13503038;p?http://java.sun.com/javaone _______________________________________________ Snort-users mailing list [2]Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: [3]https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: [4]http://www.geocrawler.com/redir-sf.php3?list=snort-users ----- joel esler 828A A216 6D95 A6BB B386 54F3 ACE3 B833 5F51 4902 ------------------------------------------------------------------------- This SF.net email is sponsored by the 2008 JavaOne(SM) Conference Don't miss this year's exciting event. There's still time to save $100. Use priority code J8TL2D2. [5]http://ad.doubleclick.net/clk;198757673;13503038;p?http://java.sun.com/javaone _______________________________________________ Snort-users mailing list [6]Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: [7]https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: [8]http://www.geocrawler.com/redir-sf.php3?list=snort-users References Visible links 1. http://ad.doubleclick.net/clk;198757673;13503038;p?http://java.sun.com/javaone 2. mailto:Snort-users () lists sourceforge net 3. https://lists.sourceforge.net/lists/listinfo/snort-users 4. http://www.geocrawler.com/redir-sf.php3?list=snort-users 5. http://ad.doubleclick.net/clk;198757673;13503038;p?http://java.sun.com/javaone 6. mailto:Snort-users () lists sourceforge net 7. https://lists.sourceforge.net/lists/listinfo/snort-users 8. http://www.geocrawler.com/redir-sf.php3?list=snort-users
------------------------------------------------------------------------- This SF.net email is sponsored by the 2008 JavaOne(SM) Conference Don't miss this year's exciting event. There's still time to save $100. Use priority code J8TL2D2. http://ad.doubleclick.net/clk;198757673;13503038;p?http://java.sun.com/javaone
_______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
----- joel esler 828A A216 6D95 A6BB B386 54F3 ACE3 B833 5F51 4902 ------------------------------------------------------------------------- This SF.net email is sponsored by the 2008 JavaOne(SM) Conference Don't miss this year's exciting event. There's still time to save $100. Use priority code J8TL2D2. http://ad.doubleclick.net/clk;198757673;13503038;p?http://java.sun.com/javaone _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Re: snort + mysql, (continued)
- Re: snort + mysql Paolo (Apr 22)
- Re: snort + mysql sahil aggrawal (Apr 22)
- Re: snort + mysql Paolo (Apr 22)
- Re: snort + mysql YARICK (Apr 22)
- Re: snort + mysql sahil aggrawal (Apr 22)
- Re: snort + mysql Paolo (Apr 22)
- Re: snort + mysql Lamanary Ramos de Pina (Apr 23)
- Re: snort + mysql Joel Esler (Apr 23)
- Re: snort + mysql Paul Melson (Apr 23)
- Re: snort + mysql Joel Esler (Apr 23)
- Re: snort + mysql Paul Melson (Apr 24)
- Re: snort + mysql Joel Esler (Apr 23)
- Re: snort + mysql JJ Cummings (Apr 23)
- Re: snort + mysql Joel Esler (Apr 23)
- Secure Connection - Barnyard -> DB Randal T. Rioux (May 15)
- Barnyard / PostgreSQL / Solaris Randal T. Rioux (May 23)
- Re: Barnyard / PostgreSQL / Solaris Todd Wease (May 24)
- Re: Barnyard / PostgreSQL / Solaris Randal T. Rioux (May 24)