When did this change?

[Paul Schmehl <pauls () utdallas edu>]

I've been doing some updating on a snort box, and I had to troubleshoot 
some problems.  While in the midst of that, I discovered something that 
shocked me.  The schema for the database (mysql) has changed dramatically. 
(I'm running snort 2.1.2 on FreeBSD.)

Here's the old schema:
mysql> show tables;
+-------------------------+
| Tables_in_archive_MAY04 |
+-------------------------+
| data                    |
| detail                  |
| encoding                |
| event                   |
| icmphdr                 |
| iphdr                   |
| opt                     |
| reference               |
| reference_system        |
| schema                  |
| sensor                  |
| sig_class               |
| sig_reference           |
| signature               |
| tcphdr                  |
| udphdr                  |
+-------------------------+
16 rows in set (0.00 sec)

And here's the new schema:

mysql> show tables;
+--------------------+
| Tables_in_snort    |
+--------------------+
| acid_ag            |
| acid_ag_alert      |
| acid_event         |
| acid_ip_cache      |
| actions            |
| data               |
| detail             |
| encoding           |
| event              |
| flags              |
| frequent_offenders |
| hostnames          |
| icmphdr            |
| ids_collection     |
| ids_live_track     |
| ids_logs           |
| ids_mark           |
| ids_oad_buffer     |
| ids_ops            |
| ids_sensors        |
| ids_track          |
| iphdr              |
| opt                |
| protocols          |
| reference          |
| reference_system   |
| schema             |
| sensor             |
| sig_class          |
| sig_reference      |
| signature          |
| tcphdr             |
| timezones          |
| udphdr             |
| users              |
+--------------------+
35 rows in set (0.00 sec)

When did the schema change?  Obviously this changes things dramatically. 
Not the least my database archiving script.  It also raises some questions.

I've done some reading, and I understand these extra tables come from the 
snort_extra file in the contrib directory, but I'm wondering if anyone 
knows when FBSD started including these in the standard install.

"frequent_offenders" - is this being used now?  Or is it for the future?
"users" - what is this for?
"ids_..." - what are these for?

Paul Schmehl (pauls () utdallas edu)
Adjunct Information Security Officer
The University of Texas at Dallas
AVIEN Founding Member
http://www.utdallas.edu


-------------------------------------------------------
This SF.Net email sponsored by Black Hat Briefings & Training.
Attend Black Hat Briefings & Training, Las Vegas July 24-29 - 
digital self defense, top technical experts, no vendor pitches, 
unmatched networking opportunities. Visit www.blackhat.com
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users