pf_ring, openfpc, snort and snorby

["Matheus Condi'ez" <conma293 () gmail com>]

In short, after many builds of snort sensors I am about to start off on a
new journey of discovery which will potentially send me mad.

My goal is to create a sensor(s) which runs OpenFPC on PF_Ring native, with
snort sitting on top as a guest vm.

Has anyone had any experience with PF_Ring and snort, or PF_Ring and snort?

Am aware that I will have to patch PF_Ring onto both the host and the guest
OS's for this to work.

Am also aware that most likely will have to build and configure OpenFPC
and/or Snort as PF_Ring aware?

If I do this but then attempt to run a version of Snort and/or OpenFPC that
is not configured to handle PF_Ring, will it take it?



Finally - I want to send all this information to a centralised Snorby GUI,
so another question is, how do I get Snorby to differentiate between
different sensor IP's to grab the pcaps from the difference OpenFPC
instances?

im sure someone has been overly ambitious and has attempted some, if not
all of this before..

any guidance would be muchly appreciated.

-conma

------------------------------------------------------------------------------
Download BIRT iHub F-Type - The Free Enterprise-Grade BIRT Server
from Actuate! Instantly Supercharge Your Business Reports and Dashboards
with Interactivity, Sharing, Native Excel Exports, App Integration & more
Get technology previously reserved for billion-dollar corporations, FREE
http://pubads.g.doubleclick.net/gampad/clk?id=164703151&iu=/4140/ostg.clktrk

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!