Re: snort + mysql

[Joel Esler <joel.esler () sourcefire com>]

Just for clairification, I said "dropped" because Lamanary said 'dropped', and in the context he's saying it in, 
dropped does not mean "dropped packets" as in the "engine can't handle the packet, so it drops it", it means the inline 
sense of the word, which inside Sourcefire we call "Blocked".

Sourcefire shows you when a packet has been blocked or not.  

J



JJ Cummings said:
>    A few things..
>
>    you are using the term "IPS", have you compiled snort inline and are thus
>    running it inline, or using snortsam?
>
>    If you simply want to know about "dropped" packets relative to processing
>    stats... kill -USR1 <snortpidfoo> will dump that info for you.
>
>    Yes, you can run squil and base together... but they are certainly
>    different tools.... squil uses much more than just snort... as to guides i
>    would suggest NSMwiki.org
>
>    Once you get squil running you simply add the configuration to your by...
>    no different than if you were dumping syslog and mysql with by....
>
>    JJC
>
>    Joel Esler wrote:
>
>  I am going to do my best to not plug Sourcefire.
>
>  Sourcefire shows you when a packet has been dropped or not.
>
>  Did I do okay?
>
>  J
>
>
>
>  Lamanary Ramos de Pina said:
>
>
>     Hi all,
>
>     I have a centos+snort+base ips set and is quite difficult to me to "see"
>     the results of the drops on BASE console. I understand that a sdrop
>     doesn't produce any alert but that's not what I want.
>
>     Is there anything like BASE (free or not) that runs over snort that gives
>     me a different feedback on the alerts, logs and drops namely?
>
>     I read something about sguil and i would like to know if is possible to
>     run it together with base? if yes, can you point me a good tutorial?
>
>     Yes, I admit that I haven't googled enough on this yet, I'm just asking
>     for a shotcut here.
>
>     Thanks
>
>
>
>
>  -------------------------------------------------------------------------
>  This SF.net email is sponsored by the 2008 JavaOne(SM) Conference
>  Don't miss this year's exciting event. There's still time to save $100.
>  Use priority code J8TL2D2.
>  [1]http://ad.doubleclick.net/clk;198757673;13503038;p?http://java.sun.com/javaone
>
>
>
>
>  _______________________________________________
>  Snort-users mailing list
>  [2]Snort-users () lists sourceforge net
>  Go to this URL to change user options or unsubscribe:
>  [3]https://lists.sourceforge.net/lists/listinfo/snort-users
>  Snort-users list archive:
>  [4]http://www.geocrawler.com/redir-sf.php3?list=snort-users
>
>
>
>
>
>
>
>
>  -----
>  joel esler
>  828A A216 6D95 A6BB B386  54F3 ACE3 B833 5F51 4902
>
>  -------------------------------------------------------------------------
>  This SF.net email is sponsored by the 2008 JavaOne(SM) Conference
>  Don't miss this year's exciting event. There's still time to save $100.
>  Use priority code J8TL2D2.
>  [5]http://ad.doubleclick.net/clk;198757673;13503038;p?http://java.sun.com/javaone
>  _______________________________________________
>  Snort-users mailing list
>  [6]Snort-users () lists sourceforge net
>  Go to this URL to change user options or unsubscribe:
>  [7]https://lists.sourceforge.net/lists/listinfo/snort-users
>  Snort-users list archive:
>  [8]http://www.geocrawler.com/redir-sf.php3?list=snort-users
>
>
> References
>
>    Visible links
>    1. http://ad.doubleclick.net/clk;198757673;13503038;p?http://java.sun.com/javaone
>    2. mailto:Snort-users () lists sourceforge net
>    3. https://lists.sourceforge.net/lists/listinfo/snort-users
>    4. http://www.geocrawler.com/redir-sf.php3?list=snort-users
>    5. http://ad.doubleclick.net/clk;198757673;13503038;p?http://java.sun.com/javaone
>    6. mailto:Snort-users () lists sourceforge net
>    7. https://lists.sourceforge.net/lists/listinfo/snort-users
>    8. http://www.geocrawler.com/redir-sf.php3?list=snort-users

> -------------------------------------------------------------------------
> This SF.net email is sponsored by the 2008 JavaOne(SM) Conference 
> Don't miss this year's exciting event. There's still time to save $100. 
> Use priority code J8TL2D2. 
> http://ad.doubleclick.net/clk;198757673;13503038;p?http://java.sun.com/javaone

> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users







-----
joel esler
828A A216 6D95 A6BB B386  54F3 ACE3 B833 5F51 4902 

-------------------------------------------------------------------------
This SF.net email is sponsored by the 2008 JavaOne(SM) Conference 
Don't miss this year's exciting event. There's still time to save $100. 
Use priority code J8TL2D2. 
http://ad.doubleclick.net/clk;198757673;13503038;p?http://java.sun.com/javaone
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users