Snort mailing list archives
Re: CVS or 1.7?
From: Andreas Hasenack <andreas () conectiva com br>
Date: Mon, 11 Jun 2001 14:41:23 -0300
Em Mon, Jun 11, 2001 at 10:51:39AM -0400, Jay Moore escreveu:
I have been playing around with snort 1.7 and acid. The box I have been playing with died. Which is not necessarily a bad thing. Gives me a chance to go back and setup everything the right way now that I have learned more about snort. The box will sit behind a firewall. I would like to know if I should run with the latest CVS build of snort. Or stay with 1.7. I don't mind downloading CVS builds. I will be logging to mysql and running acid. What features are in 1.8cvs that are not in 1.7. Are the features worth it
I think, since you will be using ACID and SQL, that the best new feature is the database schema, which should make the acid reports much faster and upgrades easier. I had a database with about 33000 alerts and snort 1.7 (that is, schema=0), and the distinct query for the current day took about 30s. But I don't have the numbers on the new schema yet, should take a month or too to fill the new database to the same number of alerts... I'm also using acid from CVS, and it's really good and fixes some bugs in the released versions. _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: http://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- chameleon overflow Matt Hand (Jun 08)
- Re: chameleon overflow Ralf Hildebrandt (Jun 08)
- Re: chameleon overflow Paulie (Jun 08)
- Re: chameleon overflow Brian Caswell (Jun 08)
- <Possible follow-ups>
- Re: chameleon overflow Matthew Collins (Jun 11)
- CVS or 1.7? Jay Moore (Jun 11)
- Re: CVS or 1.7? Andreas Hasenack (Jun 11)
- CVS or 1.7? Jay Moore (Jun 11)