Snort mailing list archives
RE: Cisco IDS
From: "Alex Butcher, ISC/ISYS" <Alex.Butcher () bristol ac uk>
Date: Wed, 19 Jan 2005 09:02:23 +0000
--On 18 January 2005 23:08 -0500 John Hally <JHally () epnet com> wrote:
That wasn't so bad, I figured I'd get flamed for posing the question :-) Actually, I have no problem building Snort, and have used it since v1.8 with good results. The main problem I have is a couple things. First, no real good mgmt interface. Snort Center was great, but it's fallen on hard times, and you can't get anything but 2.0 to run on it without doing a lot of php hacking, and I just don't have the time. For a php developer, I'm sure it can be done, but I'm the biggest hack, so it would take a lot more time for me.
Try Snortcenter2 - <http://sourceforge.net/projects/snortcenter2/>.
Second, ACID is good, but there's no real correlation/mitigation.
Look into using ACID in conjunction with OS-SIM <http://www.ossim.net/>.
Sguil looks like it's going to be something, but its just a little young, and it can be a pain to get working. I haven't tried BASE, though itlooks like it's basically the same thing.
I've diffed BASE against ACID, and I haven't seen enough significant changes to make me want to port my local ACID patchset to BASE. Eventually, I'll get round to releasing it, and the BASE guys can pick over it for features if they like.
I love the idea of RNA. I've played around with p0f recently, and even at a low level, the idea of passive OS identification is slick. I'm guessing at some point someone will hack up a version of p0f to attempt to detect applications as well.
Try pads <http://passive.sourceforge.net/>. I ported most of nmap's application signatures to pads. I sent them to pad's author and I thought he'd put them in the contrib area of the CVS, but I appear to be mistaken. If you limited pads to only reporting on your own network (i.e. a /16 or so), then performance seemed to be OK. I plan on integrating pads' results with ACID eventually. I've already done something similar for p0f in my patchset.
Best Regards, Alex. -- Alex Butcher: Security & Integrity, Personal Computer Systems Group Information Systems and Computing GPG Key ID: F9B27DC9 GPG Fingerprint: D62A DD83 A0B8 D174 49C4 2849 832D 6C72 F9B2 7DC9 ------------------------------------------------------- The SF.Net email is sponsored by: Beat the post-holiday blues Get a FREE limited edition SourceForge.net t-shirt from ThinkGeek. It's fun and FREE -- well, almost....http://www.thinkgeek.com/sfshirt _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- RE: Cisco IDS, (continued)
- RE: Cisco IDS Joe Patterson (Jan 18)
- Re: Cisco IDS Will Metcalf (Jan 18)
- Message not available
- Re: Cisco IDS Will Metcalf (Jan 17)
- Re: Cisco IDS M. Shirk (Jan 19)
- Re: Cisco IDS Alex Butcher, ISC/ISYS (Jan 19)
- Re: Cisco IDS sp0ng3b0b (Jan 27)
- Re: Cisco IDS Dave Breiland (Jan 27)
- RE: Cisco IDS Joe Patterson (Jan 18)
- RE: Cisco IDS Theodore Stout (Jan 18)
- RE: Cisco IDS Alex Butcher, ISC/ISYS (Jan 19)
- Re: Cisco IDS Bamm Visscher (Jan 19)
- Re: Cisco IDS Jason Haar (Jan 20)
- RE: Cisco IDS Alex Butcher, ISC/ISYS (Jan 19)
- RE: Cisco IDS Joe Patterson (Jan 19)
- RE: Cisco IDS Alex Butcher, ISC/ISYS (Jan 20)