Re: ACID with multiple Sensors?

[Sean Brown <sblinux () shaw ca>]

On September 27, 2004 7:25 am, Bill Warren wrote:
> All,
>
> I just got ACID, PHP, MySQL installed on my Snort box.  Then hit it hard
> with Nessus to make sure that it works and it does.  When I was reading
> the results I saw that I could search multiple senors.  So, my question
> is how do I make multiple Snort boxes talk to each other?
>
> Thanks,
> Bill
I have snort running on a firewall, I configured 2 instances, on listening on 
the internal interface and one on the external, they use different .conf 
files so it would be the same as if they were on separate machines. Here is 
the mysql line from each:

External:
output database: log,mysql,dbname=snort user=snorter host=192.168.1.2 
port=3306 sensor_name=SPARTA_FW_EXT

Internal:
output database: log,mysql,dbname=snort user=snorter host=192.168.1.2 
port=3306 sensor_name=SPARTA_FW_INT

As you can see all you have to do is point them at the same database and 
assign each one a unique name, with the aptly named sensor_name.

-Sean Brown


-------------------------------------------------------
This SF.Net email is sponsored by: YOU BE THE JUDGE. Be one of 170
Project Admins to receive an Apple iPod Mini FREE for your judgement on
who ports your project to Linux PPC the best. Sponsored by IBM.
Deadline: Sept. 24. Go here: http://sf.net/ppc_contest.php
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users