Snort mailing list archives
Re: snort + aris
From: Ron Rosson <insane () lunatic oneinsane net>
Date: Sun, 13 May 2001 09:39:56 -0700
Robert D. Hughes (rob () robhughes com) wrote:
Check the ARIS and extractor (sfclean is now extractor) docs. They'll give you the command line for both snort and extractor. Mine is /usr/local/bin/snort -A full -c /usr/local/etc/snort.conf -dDeX -i xl0 -u nobody. It works at least. Last time I checked, -A full and -d are the only required ones. -----Original Message----- From: Ron 'The InSaNe One' Rosson [mailto:insane () lunatic oneinsane net] Sent: Saturday, May 12, 2001 5:10 PM To: Ryan Russell Cc: snort-users () lists sourceforge net Subject: Re: [Snort-users] snort + aris Ryan Russell (ryan () securityfocus com) wrote:Was the question regarding how to get Snort running, or how to get it to feed to ARIS? Ryan On Fri, 11 May 2001, Ron 'The InSaNe One' Rosson wrote:I am getting ready to reset up aris on my network but I am confused on what my command line should be. Here is my basic setup: IDS system logging to a remote Database Command line for snort is: /usr/local/bin/snort -D -d -c /etc/snort.rules Here is the output part of my snort.rules file output database: alert, mysql, user=nobody dbname=snort host=postalI am looking for the proper command line to run with SNORT. TIA
If I read the man page right that overrides the databse logging. TIA -- ------------------------------------------------------------------------------ Ron Rosson ... and a UNIX user said ... The InSaNe One rm -rf * insane () oneinsane net and all was /dev/null and *void() ------------------------------------------------------------------------------ It's so nice to be insane, nobody asks you to explain. _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: http://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- snort + aris Ron 'The InSaNe One' Rosson (May 11)
- Re: snort + aris Ryan Russell (May 11)
- Re: snort + aris Ron 'The InSaNe One' Rosson (May 12)
- RE: snort + aris Aaron McKinnon (May 11)
- <Possible follow-ups>
- RE: snort + aris Robert D. Hughes (May 12)
- Re: snort + aris Ron Rosson (May 13)
- Re: snort + aris Ron 'The InSaNe One' Rosson (May 15)
- Re: snort + aris Andreas Hasenack (May 15)
- Re: snort + aris Ryan Russell (May 11)