Re: Multiple sensors

[Erek Adams <erek () theadamsfamily net>]

On Wed, 6 Mar 2002, Mike Arrison wrote:

>       I currently have a single snort box sniffing our network uplink and
> logging alerts to a mysql database on the same machine.  I'd like to setup
> other sensors on different VLANs in our network but keep alerting somehow
> centralized.  Do you suggest that I:
>
> a) Use a remote mysql database connection to send the alerts back to the
> original mysql database
> b) Is there some built in snort connectivity to gather alerts?
> c) Log locally and cron up a mysqldump every hour or so (ewww, this is an
> icky idea).

Well...  How about:

  d)  Part of (a) and something else.  :)

>       Things to consider:
>
> a) I'd prefer to keep only one set of rules, rather than different
> snort.conf etc... on each sniffer.
> b) If necessary, I can directly connect the multiple sniffers with a
> crossover cable

If your sensor are placed so that you can phyisically connect them, I'd
suggest backending them all onto a switch along with your MySQL box.  Have all
the data sent over the backend connection, with no outside connectivity.  Use
barnyard on the sensors and have it spool out to the DB.

On config files:  If all the sensors are connected over the same backend net,
use your MySQL box as a main station and rsync the rules and .conf files.
Depending on your traffic, network, and boredom you might want to consider
having different .confs for different VLANs.  On the console name them like
vlan1.conf, vlan2.conf, etc.  Rsync or scp to the snort.conf on the remote box
via a script and all should be well.

This is just one way...  There will be lots of others.  Most important thing:
DO WHAT WORKS BEST FOR YOU.  :)  This might work fine for me, but it may not
for you.

>       All suggestions welcome.  Thanks.

I suggest you send me all your money.  ;-)

Cheers!

-----
Erek Adams
Nifty-Type-Guy
TheAdamsFamily.Net


_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users