RE: Snort Sensor Hardware

[<CGhercoias () TWEC COM>]

Yes. If you chose SourceFire you'll get signatures way ahead open-source community, plus actually many more signatures 
that roughly 2000 signatures that are currently on snort.org.
At least this is what I was told by a SourceFire representative. And I believe is true.
Actually, don't you think that should be in this way? Customers who are paying big bucks should get signatures and 
support for their money, whereas we, the rest of us, which are taking things for free and use them in corporate 
environments should be left aside a little bit.
Personally I think in this way should be. You pay you get something, you don't pay, take something for free 
then......don't complain.
Plus what can be so difficult to write your own signatures? Put a sniffer on your network edge and start writing 
signatures.

Goodies? Well. At least one I would mention here. The underlying database in SourceFire is not MySQL, but something 
proprietary to them, and the front-end is lighting fast.
I've seen a box with 8 million alerts (yes, MILLIONS) in the database, with 5 users connected to it querying the same 
database(everything running in the same box -- sensor, database, front-end) and everything was running amazingly fast.
Try and do the same thing with MySQL and ACID and we will talk then.
I had this experience when Blaster hit first time in August this year, and I can tell was not fun.

Demarc? I tested it, since very beginning, when they were having just two products - Demarc personal and Demarc 
Professional. Not impressed. Vice versa I would say. Slow, and buggy. Sorry guys, but that's it.

Prelude IDS (www.prelude-ids.org) is something which someone mention it here in list, but they have to came a long way 
with documentation.
Is still in its infancy stage.

Thank you, 
___________________________
Catalin Ghercoias 
WEB/Network Security Administrator 

website: http://www.fye.com 

The content of this communication is classified as Transworld Entertainment Confidential and Proprietary 
Information.The content of this communication is intended solely for the use of the individual or entity to whom it is 
addressed and others authorized to receive it. If you are not the intended recipient you are hereby notified that any 
disclosure, copying, distribution or taking any action in reliance on the contents of this information is strictly 
prohibited and may be unlawful. If you have received this communication in error, please notify us immediately by 
responding to this communication then delete it from your system.

 
 


-----Original Message-----
From: Michael Steele [mailto:michaels () winsnort com] 
Sent: Wednesday, December 10, 2003 4:21 PM
To: 'Snort Users List'
Subject: RE: [Snort-users] Snort Sensor Hardware


What.... Signatures are being held back so Sourcefires customers will have
them first, weeks ahead of the rest of us! I don't think that's true, is it?

What kind of other goodies are we talking about here?

There is a LOT of other vendors out there so choose wisely. You hate to
spend all that money on something you might not like, or doesn't fill the
job requirements.  There are some companies that have Demo sensors they will
ship to try before you buy.

I also hear that Demarc has a new line of Sentarus sensors. Do your homework
if you are in the market for a pre-loaded sensor.

Kindest regards, 

The WINSNORT.com Management Team
-- 
Pick up your FREE Windows or UNIX Snort installation guides       
mailto:support () winsnort com
Website: http://www.winsnort.com
Snort: Open Source Network IDS - http://www.snort.org


> -----Original Message-----
> From: snort-users-admin () lists sourceforge net [mailto:snort-users-
> admin () lists sourceforge net] On Behalf Of CGhercoias () TWEC COM
> Sent: Wednesday, December 10, 2003 12:07 PM
> To: mkettler () evi-inc com; lists () itsecurity3 its uiowa edu; snort-
> users () lists sourceforge net
> Subject: RE: [Snort-users] Snort Sensor Hardware
> Importance: High
>
> Yes, I would also recommend Sourcefire. They are good, plus you'll be
> getting new signatures with weeks before they are released on the
> snort.org web site, plus a lot of other "goodies" from the fathers (and
> mothers) of snort.
>
> -----Original Message-----
> From: Matt Kettler [mailto:mkettler () evi-inc com]
> Sent: Wednesday, December 10, 2003 2:55 PM
> To: Jason Alexander; 'snort-users () lists sourceforge net'
> Subject: Re: [Snort-users] Snort Sensor Hardware
>
>
> At 02:17 PM 12/10/2003, Jason Alexander wrote:
> > Anyone have any recomendation on hardware.
>
> If you want to do a "install it yourself", personaly I like the dell
> rackmounts.. they aren't the most incredible box in the world, but they
> work well, are inexpensive, and reasonably reliable. Excellent
> bang-for-the
> buck factor without getting unstable garbage.
>
> If you want something preconfigured, sourcefire would be my
> recommendation.. (echoing Robert Shwartz).. they also have some nice
> extra
> back-end correlation tools. You'd also be supporting Marty, and the
> other
> Snort devels that work there.
>
>
>
>
> -------------------------------------------------------
> This SF.net email is sponsored by: IBM Linux Tutorials.
> Become an expert in LINUX or just sharpen your skills.  Sign up for
> IBM's
> Free Linux Tutorials.  Learn everything from the bash shell to sys
> admin.
> Click now! http://ads.osdn.com/?ad_id=1278&alloc_id=3371&op=click
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users
>
>
> -------------------------------------------------------
> This SF.net email is sponsored by: IBM Linux Tutorials.
> Become an expert in LINUX or just sharpen your skills.  Sign up for IBM's
> Free Linux Tutorials.  Learn everything from the bash shell to sys admin.
> Click now! http://ads.osdn.com/?ad_id78&alloc_id371&op=ick
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=ort-users





-------------------------------------------------------
This SF.net email is sponsored by: IBM Linux Tutorials.
Become an expert in LINUX or just sharpen your skills.  Sign up for IBM's
Free Linux Tutorials.  Learn everything from the bash shell to sys admin.
Click now! http://ads.osdn.com/?ad_id78&alloc_id371&opÕick
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list×ort-users


-------------------------------------------------------
This SF.net email is sponsored by: IBM Linux Tutorials.
Become an expert in LINUX or just sharpen your skills.  Sign up for IBM's
Free Linux Tutorials.  Learn everything from the bash shell to sys admin.
Click now! http://ads.osdn.com/?ad_id78&alloc_id371&op=click
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users