Re: Snort and Mysql for statistics purposes

[Olaf Gellert <og () pre-secure de>]

David Jiménez Domínguez wrote:

> Do you think it is the best way to do that???
> Have your ever done something like that?? What tools do you recommend me??

Well, we have done exactly the same (our Sensor
is not Snort but Prelude, but the database is
MySQL), we are doing stats on a different
level (not port numbers etc), but the statistics
are generated using Perl and rrdtools:

http://www.ecsirt.net/service/ids-sensor-data.html

There are some other teams doing the same, for example

http://www.honeypots-alliance.org.br/stats/flows/all/

http://www.switch.ch/security/services/IBN/

http://www.jpcert.or.jp/isdas/

A collection of links to incident and IDS statistics
can be found at:

http://www.ecsirt.net/service/statistics.html

Cheers, Olaf



-- 
Dipl.Inform. Olaf Gellert                  PRESECURE (R)
Senior Researcher,                       Consulting GmbH
Phone: (+49) 0700 / PRESECURE           og () pre-secure de

                        A daily view on Internet Attacks
                        https://www.ecsirt.net/sensornet



-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://ads.osdn.com/?ad_ide95&alloc_id396&op=click
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users