Re: snort ... so where from here

["Stewart L" <stewartl42 () gmail com>]

you should try to pare down the list based on your networks.   I have A HUGE
network at work (400 sites, tons of public-facing servers).  Properly
defining the web servers, DNS servers, FTP servers, etc will help.

Check the top 5 every day and see if they are valid or false positives.  If
they are false positives, whack 'em.   The guy who initially set our SNORT
box up used the complete rule set and we were getting tons of alerts.  I've
been working on it for an hour a day for a week or so and it's much more
tuned now.

Stew


On Thu, Jul 10, 2008 at 8:00 AM, Brent Clark <brentgclarklist () gmail com>
wrote:

> Hi List
>
> I got the oinkmaster working and updating, but what interested me is
> that the load average shot up just after i ran the update (specs of the
> machine arnt great).
>
> My question is, are we supposed to use ALL signatures offered, or what
> method / practices is adopted or used.
>
> Thank you in advance for you assistance in advance.
>
> Regard
> Brent Clark
>
>
>
> -------------------------------------------------------------------------
> Sponsored by: SourceForge.net Community Choice Awards: VOTE NOW!
> Studies have shown that voting for your favorite open source project,
> along with a healthy diet, reduces your potential for chronic lameness
> and boredom. Vote Now at http://www.sourceforge.net/community/cca08
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users<https://lists.sourceforge.net/lists/listinfo/snort-usersSnort-users>list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users



-- 
Stewart
--
You only lose what you cling to.

-------------------------------------------------------------------------
Sponsored by: SourceForge.net Community Choice Awards: VOTE NOW!
Studies have shown that voting for your favorite open source project,
along with a healthy diet, reduces your potential for chronic lameness
and boredom. Vote Now at http://www.sourceforge.net/community/cca08

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users