[Snort-users] barnyard

permalink · #1 (**permalink**) 01-28-2006

This is a multi-part message in MIME format.

------=_NextPart_000_001A_01C62361.532D85D0
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

Hi,

I've a question regarding barnyard (I happen to call one of my best =
friends by this name :)

I'm not sure what to do with the results.

My command line;

barnard -c /usr/local/barnyard/etc/barnyard.conf -d /var/log/snort -g =
/usr/local/snort/etc/gen-msg.map -s /usr/local/snort/etc/sid-msg.map -f =
snort.alert

I pretty much got this from the barnyard USAGE file but don't understand =
the -f option as I expect to see a snort.alert file.

I do see info in both the gen-msg.map and sid-msg.map files but am not =
sure wether I am supposed to filter or tail or cat these files.

The reason I'd like to use barnyard is that;
1) I've a gig e network and the manual says that you may want to use =
some kind of binary reader in this case for speed.
2) I'd rather not use the console output as it can be slow.
3) with barnyard I have the option of picking up where I left off in the =
event of a crashed program or system and don't have to look at the =
entire output from the begining.

Thanks in advance,
Bri-
------=_NextPart_000_001A_01C62361.532D85D0
Content-Type: text/html;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=3DContent-Type content=3D"text/html; =
charset=3Diso-8859-1">
<META content=3D"MSHTML 6.00.2900.2802" name=3DGENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=3D#ffffff>
<DIV><FONT face=3DArial size=3D2>
<DIV><FONT face=3DArial size=3D2>Hi,</FONT></DIV>
<DIV><FONT face=3DArial size=3D2></FONT> </DIV>
<DIV><FONT face=3DArial size=3D2>I've a question regarding barnyard (I =
happen to=20
call one of my best friends by this name :)</FONT></DIV>
<DIV><FONT face=3DArial size=3D2></FONT> </DIV>
<DIV><FONT face=3DArial size=3D2>I'm not sure what to do with the=20
results.</FONT></DIV>
<DIV><FONT face=3DArial size=3D2></FONT> </DIV>
<DIV><FONT face=3DArial size=3D2>My command line;</FONT></DIV>
<DIV><FONT face=3DArial size=3D2></FONT> </DIV>
<DIV><FONT face=3DArial size=3D2>barnard -c =
/usr/local/barnyard/etc/barnyard.conf -d=20
/var/log/snort -g /usr/local/snort/etc/gen-msg.map -s=20
/usr/local/snort/etc/sid-msg.map -f snort.alert</FONT></DIV>
<DIV><FONT face=3DArial size=3D2></FONT> </DIV>
<DIV><FONT face=3DArial size=3D2>I pretty much got this from the =
barnyard USAGE file=20
but don't understand the -f option as I expect to see a snort.alert=20
file.</FONT></DIV>
<DIV><FONT face=3DArial size=3D2></FONT> </DIV>
<DIV><FONT face=3DArial size=3D2>I do see info in both the gen-msg.map =
and=20
sid-msg.map files but am not sure wether I am supposed to filter or tail =
or cat=20
these files.</FONT></DIV>
<DIV><FONT face=3DArial size=3D2></FONT> </DIV>
<DIV><FONT face=3DArial size=3D2>The reason I'd like to use barnyard is=20
that;</FONT></DIV>
<DIV><FONT face=3DArial size=3D2>1) I've a gig e network and the manual =
says that=20
you may want to use some kind of binary reader in this case for=20
speed.</FONT></DIV>
<DIV><FONT face=3DArial size=3D2>2) I'd rather not use the console =
output as it can=20
be slow.</FONT></DIV>
<DIV><FONT face=3DArial size=3D2>3) with barnyard I have the option of =
picking up=20
where I left off in the event of a crashed program or system and don't =
have to=20
look at the entire output from the begining.</FONT></DIV>
<DIV><FONT face=3DArial size=3D2></FONT> </DIV>
<DIV><FONT face=3DArial size=3D2>Thanks in advance,</FONT></DIV>
<DIV><FONT face=3DArial =
size=3D2>Bri-</FONT></FONT></DIV></DIV></BODY></HTML>

------=_NextPart_000_001A_01C62361.532D85D0--

-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems? Stop! Download the new AJAX search engine that makes
searching your log files as easy as surfing the web. DOWNLOAD SPLUNK!
http://sel.as-us.falkag.net/sel?cmd=...486&dat=121642
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/...fo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.p...st=snort-users

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode