Re: Using snort as connection tracker

[Jose Maria Lopez <jkerouac () eresmas com>]

El dom, 19 de 12 de 2004 a las 16:15, Klemen Mihevc escribió:
> now i have a problem couse every packet is logged (and logs are huge)
> even if it's only about 1k big and it is product of outside scan of
> server not actual connection to it. Is there anyway to log only first
> and last package from 1 ip and only if data transfer is bigger then
> let's say 5k? Or maybe anyother way to log that connections? I also
> tryed with chaosreader & tcpdump but this method is too much cpu & ram
> consuming and i also tried with iptable but again with same problem
> (every package is logged). I relay wanna use snort because i can use
> mysql & acid for statistic...

I propose you two solutions:

1) Use just iptables (maybe this doesn't suit you because you want acid
for the stats, storing the logs in mysql it's not a problem using ULOGD)
and the connection tracking system. Use some general rules to accept
the ESTABLISHED and RELATED traffic in the chains you want to use and
then use a rule with --state NEW to log only the initial connections.

2) Use a mixed solution. You need almost the same iptables rules I
have indicated above, but you can use snort-inline and the QUEUE
feature of iptables to pass the packets to snort-inline. Then use
the rules you have in snort-inline to just log the packets to mysql
and then use Acid to see the results.

Hope it helps.


-- 
Jose Maria Lopez Hernandez
Director Tecnico de bgSEC
jkerouac () bgsec com
bgSEC Seguridad y Consultoria de Sistemas Informaticos
http://www.bgsec.com
ESPAÑA

The only people for me are the mad ones -- the ones who are mad to live,
mad to talk, mad to be saved, desirous of everything at the same time,
the ones who never yawn or say a commonplace thing, but burn, burn, burn
like fabulous yellow Roman candles.
                -- Jack Kerouac, "On the Road"



-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now. 
http://productguide.itmanagersjournal.com/
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users