distributed snort

[meling <meling () scan-associates net>]

Hi,

I'm developing a distributed intrusion detection architecture using 
Snort on the IDS sensors. We're targeting to deploy > 50 sensors on 
multiple networks. These sensors will push the alert logs to 1 central
console, where data crunching and analysis will take place.

My questions are:

1. How feasible it is to send alert logs from 50 sensors to 1 central console? 
   The central console will have several different components in itself,
   such as data parsing, etc.

2. What is the most efficient way to make sure that Snort is runnig 24x7 on
   the sensors? Is tcpserver any good? 

3. What are the best data consolidation techniques available? My concern is 
   that when too many data are displayed from various sensors on the 
   monitoring console, security analyst will tend to ignore them. 

Your input are very much appreciated.

--mel
http://ini2.net/mel 

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users