Re: Multiple Sensors/Distributed Snort Config.

["Lee Clemens" <snort () leeclemens net>]

Hi Dan,

I haven't used it much, but hear many recommend an app called Barnyard to
communicate with the database--since Snort can lose performance and drop
packets if it handles a large load of both 'snorting' and talking to the db.
http://sourceforge.net/projects/barnyard

No need for Snort on the database server, since it will only be concerned
with database connections (from Snort or Barnyard, etc) and having the
webapp to display that information. Of course you will still need to load
the schema for Snort on that db.

Perhaps a scripted solution to take a central set of rules and ensure they
are distributed correctly and timely would be a better approach than
connecting each sensor to a central file share. However, *if* Snort loads
the rules into memory, that might be a suitable approach... Perhaps someone
else will have an answer to that idea?

--Lee

-----Original Message-----
From: snort-users-bounces () lists sourceforge net
[mailto:snort-users-bounces () lists sourceforge net] On Behalf Of Dan Brummer
Sent: Thursday, July 13, 2006 1:17 PM
To: snort-users () lists sourceforge net
Subject: [Snort-users] Multiple Sensors/Distributed Snort Config.

Hello,
I have been a Snort user for quite some time now and I have a few questions
regarding setting up a distributed Snort system.  I'm planning to put
multiple sensors on my enterprise network and have all of these feed to a
central database server.  From my research I understand the best way to do
this is have each remote sensor send its Snort output using MySQL.  Is this
the best way of doing this?  Are there any applications to help me with what
I'm trying to do?  What about the rules and and making sure they're shared
and up-to-date on all the sensors?  Do I need to be running snort on the
central database server if all it's doing is receiving sensor outputs and
displaying reports using ACID or BASE?  
 
Any insight on this I would greatly appreciate it.
 
Thank you,
Dan




-------------------------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users