RE: [Snort-users] Cisco IDS

--On 18 January 2005 23:08 -0500 John Hally <JHally@epnet.com> wrote:

> That wasn't so bad, I figured I'd get flamed for posing the question :-)
>
> Actually, I have no problem building Snort, and have used it since v1.8
> with good results. The main problem I have is a couple things.
>
> First, no real good mgmt interface. Snort Center was great, but it's
> fallen on hard times, and you can't get anything but 2.0 to run on it
> without doing a lot of php hacking, and I just don't have the time. For
> a php developer, I'm sure it can be done, but I'm the biggest hack, so it
> would take a lot more time for me.

Try Snortcenter2 - <http://sourceforge.net/projects/snortcenter2/>.

> Second, ACID is good, but there's no real correlation/mitigation.

Look into using ACID in conjunction with OS-SIM <http://www.ossim.net/>.

> Sguil looks like it's going to be something, but its just a little young,
> and it can be a pain to get working. I haven't tried BASE, though it
> looks like it's basically the same thing.

I've diffed BASE against ACID, and I haven't seen enough significant
changes to make me want to port my local ACID patchset to BASE. Eventually,
I'll get round to releasing it, and the BASE guys can pick over it for
features if they like.

> I love the idea of RNA. I've played around with p0f recently, and even
> at a low level, the idea of passive OS identification is slick. I'm
> guessing at some point someone will hack up a version of p0f to attempt
> to detect applications as well.

Try pads <http://passive.sourceforge.net/>. I ported most of nmap's
application signatures to pads. I sent them to pad's author and I thought
he'd put them in the contrib area of the CVS, but I appear to be mistaken.
If you limited pads to only reporting on your own network (i.e. a /16 or
so), then performance seemed to be OK. I plan on integrating pads' results
with ACID eventually. I've already done something similar for p0f in my
patchset.

Best Regards,
Alex.
--
Alex Butcher: Security & Integrity, Personal Computer Systems Group
Information Systems and Computing GPG Key ID: F9B27DC9
GPG Fingerprint: D62A DD83 A0B8 D174 49C4 2849 832D 6C72 F9B2 7DC9




-------------------------------------------------------
The SF.Net email is sponsored by: Beat the post-holiday blues
Get a FREE limited edition SourceForge.net t-shirt from ThinkGeek.
It's fun and FREE -- well, almost....http://www.thinkgeek.com/sfshirt
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/...fo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.p...st=snort-users