Re: network audit

[twig les <twigles () yahoo com>]

You can try just commenting out all the rules files in
snort.conf and making one rule that captures all IP traffic. 
Sure you can do this to a local mysql, but if you read the
threads from a few months ago it would seem that postgresql
would be faster since your database will be huge.  I have no
idea what performance you will get since that depends on your
traffic and hardware.

I just use Acid for my queries but there may be something more
exatic that would fit your needs better.


--- avi koren <avikoren () fastmail fm> wrote:
> Hi,
>
> I'd like to use snort as a traffic archiver. (100mbit network)
> I have a few questions:
> 1. How do I configure it to archive all the traffic to a
> database ?
> 2. Can I save the full packet to the database ? (including
> frame headers,
> etc.)
> 3. How can I log both to a database and a local file ? Will it
> have great
> influence on the performance ?
> 4. If I install local MySQL, will it handle the load ?
> 5. Is there a tool or option through snort in which I can
> issue sql
> queries to the database ? I want to select, for
>    example, 3 days back all the packets to a libpcap format
> file, so I
>    can analyze it.
>
> thank you very much
> -- 
>   avi koren
>   avikoren () fastmail fm
>
> -- 
> http://www.fastmail.fm - Email service worth paying for. Try
> it for free
>
>
> -------------------------------------------------------
> This SF.net email is sponsored by:Crypto Challenge is now
> open! 
> Get cracking and register here for some mind boggling fun and 
> the chance of winning an Apple iPod:
> http://ads.sourceforge.net/cgi-bin/redirect.pl?thaw0031en
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users


=====
-----------------------------------------------------------
Know yourself and know your enemy and you will never fear defeat.         
-----------------------------------------------------------

__________________________________________________
Do you Yahoo!?
Yahoo! Web Hosting - establish your business online
http://webhosting.yahoo.com


-------------------------------------------------------
This SF.net email is sponsored by:Crypto Challenge is now open! 
Get cracking and register here for some mind boggling fun and 
the chance of winning an Apple iPod:
http://ads.sourceforge.net/cgi-bin/redirect.pl?thaw0031en
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users