Snort mailing list archives
Re: New user question(s)
From: Jason <security () brvenik com>
Date: Wed, 22 Sep 2004 09:20:12 -0400
Chris wrote:
I've setup snort, modified the snort.conf, have it running, but, reading the FAQ I've got a few questions.1. What is the difference in running snortd vice snort w/cl parameters?2. Reading the FAQ it states to start snort with snort -A full -c snort.conf then in the next line it states:Note that the default output mode (-A full) of snort should not be used exceptin very controlled environments. It is the slowest way to run snort and presents several hard to recover from problems with inode creation on filesystems. So, if this causes problems, how then should snort be started?
You should use unified or binary logging, unified output is preferred these days since you can get everything you need by post processing the files using barnyard. The documentation for barnyard is in the tarball available at snort.org http://www.snort.org/dl/barnyard/
3. I run no servers on my box. I've set it up in the belief that if would compliment my firewall. If my firewall is working sufficiently in my opinion, then do I even need to run an IDS?
Absolutely needed. Your firewall does not protect from application level attacks and is subject to configuration issues, the IDS is a great compliment to the firewall allowing you to audit what is really happening.
I apologize in advance for the seemingly "dumb newbie questions"
------------------------------------------------------- This SF.Net email is sponsored by: YOU BE THE JUDGE. Be one of 170 Project Admins to receive an Apple iPod Mini FREE for your judgement on who ports your project to Linux PPC the best. Sponsored by IBM. Deadline: Sept. 24. Go here: http://sf.net/ppc_contest.php _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- New user question(s) Chris (Sep 22)
- Re: New user question(s) Jason (Sep 22)
- Re: New user question(s) Matt Kettler (Sep 22)
- <Possible follow-ups>
- RE: New user question(s) Harper, Patrick (Sep 22)
- Re: New user question(s) Chris (Sep 22)
- RE: New user question(s) Harper, Patrick (Sep 22)