Snort mailing list archives
Re: Sensor 'sanity'
From: "Paul Halliday" <paul.halliday () gmail com>
Date: Fri, 9 Nov 2007 07:19:25 -0400
Inline.. On Nov 8, 2007 10:09 PM, Matt Jonkman <jonkman () jonkmans com> wrote:
You mean for faults like the span port was broken by the network guys, or started seeing only one part of a stream, or lost a chunk of it's monitored traffic?
Exactly.
For the basics you could just use traffic monitoring, if it drops below a threshold shoot you an alert. What else did you have in mind?
I guess what I am looking for is an event generated by snort that will appear in my console - perfmon looks like it might have the ability. I would hate to add an extra component to every sensor just to tell me it is frigged when snort might already have the ability to do so.
Matt Paul Halliday wrote:Hi, I am not sure about how most people deal with this but I would love any insight. In an overtaxed environment where I just don't have the time to coddle each sensor, what is a common practice to make sure that the sensors are actually still sane? Most of my sensors are sittings on span/mirrored ports on gear that I don't directly manage. Is/would it be possible to construct a preprocessor that could actually fire and tell me that the link isn't 'typical' anymore? Thanks. ------------------------------------------------------------------------- This SF.net email is sponsored by: Splunk Inc. Still grepping through log files to find problems? Stop. Now Search log events and configuration files using AJAX and a browser. Download your FREE copy of Splunk now >> http://get.splunk.com/ _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users-- -------------------------------------------- Matthew Jonkman Bleeding Edge Threats US Phone 765-429-0398 US Fax 312-264-0205 AUS Phone 61-42-4157-491 AUS Fax 61-29-4750-026 http://www.bleedingthreats.net -------------------------------------------- PGP: http://www.bleedingthreats.com/mattjonkman.asc
------------------------------------------------------------------------- This SF.net email is sponsored by: Splunk Inc. Still grepping through log files to find problems? Stop. Now Search log events and configuration files using AJAX and a browser. Download your FREE copy of Splunk now >> http://get.splunk.com/ _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Sensor 'sanity' Paul Halliday (Nov 08)
- Message not available
- Re: Sensor 'sanity' Paul Halliday (Nov 09)
- Message not available
- Re: Sensor 'sanity' Jason Haar (Nov 11)
- snort virtualization Youngquist, Jason R. (Nov 14)
- Re: snort virtualization Justin Heath (Nov 14)
- snort virtualization Youngquist, Jason R. (Nov 14)