Any using snort on solaris 10 with zones

[Greg Cope <gregcope () gmail com>]

Hi all,

I have a requirement to monitor "all traffic" (pci req 11).  The vlan  
in question has 2 hosts.  A single windows host (physical) and a  
solaris 10 host run a small number of zones.

I know solaris zones pose a challenge as interzone trafic will not go  
to the wire with shared IP.  Although not ideal interzone traffic  
should be trusted and I am more conceded with exterior traffic.

There are few services to monitor an so the snort config should be  
simple.

Anyone else doing this with snort?  Care to share experiences good or  
bad?  Am I mad or will this work.

Also looking to use something like oosec to do host integrity and log  
monitoring including snort reporting/alerting.

Is there a better place to ask such questions?

Many thanks.

Greg

------------------------------------------------------------------------------
Download Intel® Parallel Studio Eval
Try the new software tools for yourself. Speed compiling, find bugs
proactively, and fine-tune applications for parallel performance.
See why Intel Parallel Studio got high marks during beta.
http://p.sf.net/sfu/intel-sw-dev
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users