Snort mailing list archives
Re: General snort question
From: Matt Kettler <mkettler () evi-inc com>
Date: Fri, 10 Sep 2004 15:38:43 -0400
At 03:31 PM 9/10/2004, Wendell Smith wrote:
So I have just installed Snort/Acid on a test server of mine and for the most part, I'm really enjoying the functionality these two apps provide. I would like to deploy this IDS on my WAN exposed servers. My question to the list is: Can I do this in a way such that I don't have to install Snort, Acid, Apache, PHP, MySQL, etc on each of these WAN exposed machines.
Do you really need or even want separate collections per server? Are your wan exposed servers all in their own subnet (ie: all in one DMZ)?In general I'd just use a managed switch for the DMZ, and configure a span port to monitor the link up to your firewall or router. Run the span to a snort box and sniff the whole subnet's internet traffic all at once.
If you've got a couple DMZs, you can add extra interfaces to your snort box and just run multiple instances of snort on the same machine, or use bonding to bond the interfaces and have a single snort use the bonded interface.
------------------------------------------------------- This SF.Net email is sponsored by: YOU BE THE JUDGE. Be one of 170 Project Admins to receive an Apple iPod Mini FREE for your judgement onwho ports your project to Linux PPC the best. Sponsored by IBM. Deadline: Sept. 13. Go here: http://sf.net/ppc_contest.php
_______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- General snort question Wendell Smith (Sep 10)
- Re: General snort question Matt Kettler (Sep 10)
- <Possible follow-ups>
- Re: General snort question Lyndon Tiu (Sep 10)
- RE: General snort question McCash, John (Sep 10)
- Message not available
- RE: General snort question Wendell Smith (Sep 10)
- RE: General snort question Alex Butcher, ISC/ISYS (Sep 16)
- Message not available