Re: New snort install question

[Vivek Rajagopalan <vivek () unleashnetworks com>]

Apologies, meant to reply to list.

On 22-05-2012 02:49, Sallee, Stephen (Jake) wrote:
> > ... what are you trying to achieve...
>
> We are indeed trying to protect our LAN from internal threats.  We 
> have a well-protected internet facing edge but as a university we have 
> a few thousand non-university owned assets that access our network 
> every day.  Once these devices are on my network they have bypassed my 
> armored edge and are able to poke away at my soft belly ... I don't 
> like that.

Are these non-university machines on a guest VLAN ? If they are, then a 
BPF filter on Snort can help cut down the 'trusted' traffic. This means 
your i3 Dells might be sufficient for the workload.

As far as deploying this over 50+ buildings are concerned have you 
checked out the Security Onion distro ?

Hope that helps,

Vivek

------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and 
threat landscape has changed and how IT managers can respond. Discussions 
will include endpoint security, mobile security and the latest in malware 
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!