[Snort-users] RE: Snort-users digest, Vol 1 #4438 - 9 msgs

Re: Snort and Sflow

John, I have worked extensively with sFlow and SNORT. The two =
technologies
can be used together very effectively with some tweaking. You might send
your snort.conf file as that is probably where any changes will need to =
be
made.

Perhaps there will be a future release of SNORT that provides an option =
to
natively recognize sFlow packets and utilize a "modified" ruleset that =
works
well with sampled data. Any takers?

By the way, I would be interested in knowing what equipment you are =
using to
collect sFlow samples.

Thanks,
Kim


-----Original Message-----
From: snort-users-admin@lists.sourceforge.net
[mailto:snort-users-admin@lists.sourceforge.net] On Behalf Of
snort-users-request@lists.sourceforge.net
Sent: Tuesday, August 03, 2004 9:52 PM
To: snort-users@lists.sourceforge.net
Subject: Snort-users digest, Vol 1 #4438 - 9 msgs


Message: 6
Date: Tue, 03 Aug 2004 16:35:30 -0400
To: snort-users@lists.sourceforge.net
From: "John Dombrowski" <johndombrowski@tk.k12.mi.us>
Subject: [Snort-users] Snort and SFlow

Hello all, I am having trouble getting snort to read my sFLow samples.

I am using the sflowtool and piping it to snort, I think I am using a =
good
command, snort starts and all, but when I do a port scan on the box, or
any other server, no alerts ever come up. I'm thinking I need to change
something else in the snort.conf file or something.

Any help would be appreciated.

Thanks,

John Dombrowski
Systems Administrator
Thornapple Kellogg Schools
johndombrowski@tk.k12.mi.us
616.795.5430




---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.729 / Virus Database: 484 - Release Date: 7/27/2004
=20



-------------------------------------------------------
This SF.Net email is sponsored by OSTG. Have you noticed the changes on
Linux.com, ITManagersJournal and NewsForge in the past few weeks? Now,
one more big change to announce. We are now OSTG- Open Source Technology
Group. Come see the changes on the new OSTG site. www.ostg.com
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/...fo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.p...st=snort-users