RE: [Snort-users] When did this change?

It hasn't changed.. Those additional tables were installed by Aanval
Intrusion Detection Console. You must have installed it between May04 and
now.

Cheers,
Jeff

-----Original Message-----
From: snort-users-admin@lists.sourceforge.net
[mailto:snort-users-admin@lists.sourceforge.net] On Behalf Of Paul Schmehl
Sent: Sunday, June 27, 2004 2:59 PM
To: snort-users@lists.sourceforge.net
Subject: [Snort-users] When did this change?

I've been doing some updating on a snort box, and I had to troubleshoot
some problems. While in the midst of that, I discovered something that
shocked me. The schema for the database (mysql) has changed dramatically.
(I'm running snort 2.1.2 on FreeBSD.)

Here's the old schema:
mysql> show tables;
+-------------------------+
| Tables_in_archive_MAY04 |
+-------------------------+
| data |
| detail |
| encoding |
| event |
| icmphdr |
| iphdr |
| opt |
| reference |
| reference_system |
| schema |
| sensor |
| sig_class |
| sig_reference |
| signature |
| tcphdr |
| udphdr |
+-------------------------+
16 rows in set (0.00 sec)

And here's the new schema:

mysql> show tables;
+--------------------+
| Tables_in_snort |
+--------------------+
| acid_ag |
| acid_ag_alert |
| acid_event |
| acid_ip_cache |
| actions |
| data |
| detail |
| encoding |
| event |
| flags |
| frequent_offenders |
| hostnames |
| icmphdr |
| ids_collection |
| ids_live_track |
| ids_logs |
| ids_mark |
| ids_oad_buffer |
| ids_ops |
| ids_sensors |
| ids_track |
| iphdr |
| opt |
| protocols |
| reference |
| reference_system |
| schema |
| sensor |
| sig_class |
| sig_reference |
| signature |
| tcphdr |
| timezones |
| udphdr |
| users |
+--------------------+
35 rows in set (0.00 sec)

When did the schema change? Obviously this changes things dramatically.
Not the least my database archiving script. It also raises some questions.

I've done some reading, and I understand these extra tables come from the
snort_extra file in the contrib directory, but I'm wondering if anyone
knows when FBSD started including these in the standard install.

"frequent_offenders" - is this being used now? Or is it for the future?
"users" - what is this for?
"ids_..." - what are these for?

Paul Schmehl (pauls@utdallas.edu)
Adjunct Information Security Officer
The University of Texas at Dallas
AVIEN Founding Member
http://www.utdallas.edu


-------------------------------------------------------
This SF.Net email sponsored by Black Hat Briefings & Training.
Attend Black Hat Briefings & Training, Las Vegas July 24-29 -
digital self defense, top technical experts, no vendor pitches,
unmatched networking opportunities. Visit www.blackhat.com
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/...fo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.p...st=snort-users




-------------------------------------------------------
This SF.Net email sponsored by Black Hat Briefings & Training.
Attend Black Hat Briefings & Training, Las Vegas July 24-29 -
digital self defense, top technical experts, no vendor pitches,
unmatched networking opportunities. Visit www.blackhat.com
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/...fo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.p...st=snort-users