RE: snort + aris

["Robert D. Hughes" <rob () robhughes com>]

Check the ARIS and extractor (sfclean is now extractor) docs. They'll give
you the command line for both snort and extractor. Mine is
/usr/local/bin/snort -A full -c /usr/local/etc/snort.conf -dDeX -i xl0 -u
nobody. It works at least. Last time I checked, -A full and -d are the only
required ones.

-----Original Message-----
From: Ron 'The InSaNe One' Rosson [mailto:insane () lunatic oneinsane net]
Sent: Saturday, May 12, 2001 5:10 PM
To: Ryan Russell
Cc: snort-users () lists sourceforge net
Subject: Re: [Snort-users] snort + aris


Ryan Russell (ryan () securityfocus com) wrote:
> Was the question regarding how to get Snort running, or how to get it to
> feed to ARIS?
>
>                       Ryan
>
> On Fri, 11 May 2001, Ron 'The InSaNe One' Rosson wrote:
>
> > I am getting ready to reset up aris on my network but I am confused on
> > what my command line should be.
> >
> > Here is my basic setup:
> >
> > IDS system logging to a remote Database
> >
> > Command line for snort is:
> > /usr/local/bin/snort -D -d -c /etc/snort.rules
> >
> > Here is the output part of my  snort.rules file
> >
> > output database: alert, mysql, user=nobody dbname=snort host=postal

I am looking for the proper command line to run with SNORT.

TIA

-- 
-----------------------------------------------------------------------------
-
Ron Rosson                                    ... and a UNIX user said ...
The InSaNe One                                        rm -rf *
insane () oneinsane net                     and all was /dev/null and *void()
-----------------------------------------------------------------------------
-
   If Bill Gates had a dime for every time a Windows box crashed...
                ...Oh, wait a minute, he already does.

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users


_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users