RE: Snort-users digest, Vol 1 #4438 - 9 msgs

["Kim Wall" <kwall () the4walls net>]

Re: Snort and Sflow

John, I have worked extensively with sFlow and SNORT. The two technologies
can be used together very effectively with some tweaking. You might send
your snort.conf file as that is probably where any changes will need to be
made.

Perhaps there will be a future release of SNORT that provides an option to
natively recognize sFlow packets and utilize a "modified" ruleset that works
well with sampled data. Any takers?

By the way, I would be interested in knowing what equipment you are using to
collect sFlow samples.

Thanks,
Kim


-----Original Message-----
From: snort-users-admin () lists sourceforge net
[mailto:snort-users-admin () lists sourceforge net] On Behalf Of
snort-users-request () lists sourceforge net
Sent: Tuesday, August 03, 2004 9:52 PM
To: snort-users () lists sourceforge net
Subject: Snort-users digest, Vol 1 #4438 - 9 msgs


Message: 6
Date: Tue, 03 Aug 2004 16:35:30 -0400
To: snort-users () lists sourceforge net
From: "John Dombrowski" <johndombrowski () tk k12 mi us>
Subject: [Snort-users] Snort and SFlow

Hello all, I am having trouble getting snort to read my sFLow samples.

I am using the sflowtool and piping it to snort, I think I am using a good
command, snort starts and all, but when I do a port scan on the box, or
any other server, no alerts ever come up.  I'm thinking I need to change
something else in the snort.conf file or something.

Any help would be appreciated.

Thanks,

John Dombrowski
Systems Administrator
Thornapple Kellogg Schools
johndombrowski () tk k12 mi us
616.795.5430




---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.729 / Virus Database: 484 - Release Date: 7/27/2004
 



-------------------------------------------------------
This SF.Net email is sponsored by OSTG. Have you noticed the changes on
Linux.com, ITManagersJournal and NewsForge in the past few weeks? Now,
one more big change to announce. We are now OSTG- Open Source Technology
Group. Come see the changes on the new OSTG site. www.ostg.com
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users