Re: Encrypted sessions

[Fyodor <fygrave () tigerteam net>]

On Thu, Nov 29, 2001 at 09:25:59AM +0800, Ju Kong Fui wrote:
> Rather than building decryption module into snort, I suggest to build a host
> based "snort", using the same signature as the existing network based
> "snort". Both host based and network based "snort" can log to the same log
> repository and then report it using ACID or any other reporting
> plug-in/tools.

What do you mean by 'host based snort'? Running snort on loopback and
having another process which would act as 'ssl accelerator'? (stunnel
could do that f.e.). The only thing which you won't be able to see here
is the actual source of offending requests, you'll have to analyse
stunnel logs for that.


_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users