Re: Snort to monitor several servers

["Gene R Gomez" <gene () gomezbrothers com>]

Jacob,

> How would you compare Snort to Samhain?
> Can't Snort do the same?

Eh...not really.  The focus is different.  Snort detects intrusions by
reviewing network data.  Samhain (and other HIDS in general) detect
intrusions by reviewing data on the local system.  Samhain in particular
is a File Integrity Checker, meaning it detects changes in files and
configurations on the local system.
There are other host-related methods for determining intrusion, as well. 
Prelude-LML, for example, is a log parser that looks for anamalous events
in flatfile and syslog streams.
So, the technologies are really complementary.  If you deploy Snort in a
few key locations to cover the network traffic, you can then deploy HIDS
and hopefully detect things you wouldn't have seen with Snort (for
example, HTTP exploits running within SSL sessions which you can detect
via something like mod_security).
Since Snort is network-centric, it really is more efficient to have a few
deployments in key locations, and supplement detection with host-based
solutions.

- Ramon


-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems?  Stop!  Download the new AJAX search engine that makes
searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
http://ads.osdn.com/?ad_id=7637&alloc_id=16865&op=click
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users