Snort mailing list archives
When did this change?
From: Paul Schmehl <pauls () utdallas edu>
Date: Sun, 27 Jun 2004 13:59:06 -0500
I've been doing some updating on a snort box, and I had to troubleshoot some problems. While in the midst of that, I discovered something that shocked me. The schema for the database (mysql) has changed dramatically. (I'm running snort 2.1.2 on FreeBSD.)
Here's the old schema: mysql> show tables; +-------------------------+ | Tables_in_archive_MAY04 | +-------------------------+ | data | | detail | | encoding | | event | | icmphdr | | iphdr | | opt | | reference | | reference_system | | schema | | sensor | | sig_class | | sig_reference | | signature | | tcphdr | | udphdr | +-------------------------+ 16 rows in set (0.00 sec) And here's the new schema: mysql> show tables; +--------------------+ | Tables_in_snort | +--------------------+ | acid_ag | | acid_ag_alert | | acid_event | | acid_ip_cache | | actions | | data | | detail | | encoding | | event | | flags | | frequent_offenders | | hostnames | | icmphdr | | ids_collection | | ids_live_track | | ids_logs | | ids_mark | | ids_oad_buffer | | ids_ops | | ids_sensors | | ids_track | | iphdr | | opt | | protocols | | reference | | reference_system | | schema | | sensor | | sig_class | | sig_reference | | signature | | tcphdr | | timezones | | udphdr | | users | +--------------------+ 35 rows in set (0.00 sec)When did the schema change? Obviously this changes things dramatically. Not the least my database archiving script. It also raises some questions.
I've done some reading, and I understand these extra tables come from the snort_extra file in the contrib directory, but I'm wondering if anyone knows when FBSD started including these in the standard install.
"frequent_offenders" - is this being used now? Or is it for the future? "users" - what is this for? "ids_..." - what are these for? Paul Schmehl (pauls () utdallas edu) Adjunct Information Security Officer The University of Texas at Dallas AVIEN Founding Member http://www.utdallas.edu ------------------------------------------------------- This SF.Net email sponsored by Black Hat Briefings & Training.Attend Black Hat Briefings & Training, Las Vegas July 24-29 - digital self defense, top technical experts, no vendor pitches, unmatched networking opportunities. Visit www.blackhat.com
_______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Announcement PigMail v. 1.01 Adam Ely (Jun 10)
- When did this change? Paul Schmehl (Jun 27)
- RE: When did this change? Jeff Dell (Jun 27)
- RE: When did this change? Paul Schmehl (Jun 27)
- RE: When did this change? Frank Knobbe (Jun 29)
- RE: When did this change? Jeff Dell (Jun 29)
- RE: When did this change? Jeff Dell (Jun 27)
- When did this change? Paul Schmehl (Jun 27)