Re: RE: Network Behaviour Anomoly Detection

[Bamm Visscher <bamm.visscher () gmail com>]

I think barnyard can read the file via dp_stream_stat, but AFAIK,
there are no output plugins that can do anything with the data (yet). 
I think Marty meant to imply that you would need to write that
portion.

Bammkkkk

On Wed, 14 Jul 2004 12:12:07 -0400, sekure <sekure () gmail com> wrote:
> On Tue, 13 Jul 2004 14:55:38 -0400, Martin Roesch <roesch () sourcefire com> wrote:
> > The binary format can be read by barnyard (file "snort-unified.stats")
> > which would work great for a post-processed anomaly detector if you
> > wanted near real-time performance.
>
> Barnyard 0.2.0 had no idea what to do with the unified file.  It
> mentioned something about unknown input filter.  Has anyone been able
> to process a unified output from stream4 with barnyard?  Care to share
> your config?
>
>
>
>
> -------------------------------------------------------
> This SF.Net email sponsored by Black Hat Briefings & Training.
> Attend Black Hat Briefings & Training, Las Vegas July 24-29 -
> digital self defense, top technical experts, no vendor pitches,
> unmatched networking opportunities. Visit www.blackhat.com
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users


-- 
http://sguil.sf.net


-------------------------------------------------------
This SF.Net email is sponsored by BEA Weblogic Workshop
FREE Java Enterprise J2EE developer tools!
Get your free copy of BEA WebLogic Workshop 8.1 today.
http://ads.osdn.com/?ad_id=4721&alloc_id=10040&op=click
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users