RE: Passing IP Addresses best practices

[Erek Adams <erek () snort org>]

On Tue, 23 Sep 2003, Richard Brackett wrote:

> So what's your opinion on Snort management interfaces? Is there such an
> animal out there that I can leave Snort untouched as far as rules go and
> then filter out the events I don't want after they've reached a
> management interface?

Untouched == bad idea.

Tune your rules, that's the best thing.  Use whatever interface you want,
just as long as it works for you.  Once you make rule changes use
something like Oinkmaster to do your rule updates and you should be fine.

Cheers!

-----
Erek Adams

   "When things get weird, the weird turn pro."   H.S. Thompson


-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users