Re: [Snort-users] snort + mysql

permalink · #1 (**permalink**) 04-23-2008

This is a multi-part message in MIME format.
--===============0180369227==
Content-Type: multipart/alternative;
boundary="------------010408070806080705000108"

This is a multi-part message in MIME format.
--------------010408070806080705000108
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit

A few things..

you are using the term "IPS", have you compiled snort inline and are
thus running it inline, or using snortsam?

If you simply want to know about "dropped" packets relative to
processing stats... kill -USR1 <snortpidfoo> will dump that info for you.

Yes, you can run squil and base together... but they are certainly
different tools.... squil uses much more than just snort... as to guides
i would suggest NSMwiki.org

Once you get squil running you simply add the configuration to your
by... no different than if you were dumping syslog and mysql with by....

JJC

Joel Esler wrote:
> I am going to do my best to not plug Sourcefire.
>
> Sourcefire shows you when a packet has been dropped or not.
>
> Did I do okay?
>
> J
>
>
>
> Lamanary Ramos de Pina said:
>
>> Hi all,
>>
>> I have a centos+snort+base ips set and is quite difficult to me to "see"
>> the results of the drops on BASE console. I understand that a sdrop
>> doesn't produce any alert but that's not what I want.
>>
>> Is there anything like BASE (free or not) that runs over snort that gives
>> me a different feedback on the alerts, logs and drops namely?
>>
>> I read something about sguil and i would like to know if is possible to
>> run it together with base? if yes, can you point me a good tutorial?
>>
>> Yes, I admit that I haven't googled enough on this yet, I'm just asking
>> for a shotcut here.
>>
>> Thanks
>>
>
>
>> -------------------------------------------------------------------------
>> This SF.net email is sponsored by the 2008 JavaOne(SM) Conference
>> Don't miss this year's exciting event. There's still time to save $100.
>> Use priority code J8TL2D2.
>> http://ad.doubleclick.net/clk;198757...un.com/javaone
>>
>
>
>> _______________________________________________
>> Snort-users mailing list
>> Snort-users@lists.sourceforge.net
>> Go to this URL to change user options or unsubscribe:
>> https://lists.sourceforge.net/lists/...fo/snort-users
>> Snort-users list archive:
>> http://www.geocrawler.com/redir-sf.p...st=snort-users
>>
>
>
>
>
>
>
>
> -----
> joel esler
> 828A A216 6D95 A6BB B386 54F3 ACE3 B833 5F51 4902
>
> -------------------------------------------------------------------------
> This SF.net email is sponsored by the 2008 JavaOne(SM) Conference
> Don't miss this year's exciting event. There's still time to save $100.
> Use priority code J8TL2D2.
> http://ad.doubleclick.net/clk;198757...un.com/javaone
> _______________________________________________
> Snort-users mailing list
> Snort-users@lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/...fo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.p...st=snort-users
>

--------------010408070806080705000108
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit

<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
A few things.. 
 
you are using the term "IPS", have you compiled snort inline and are
thus running it inline, or using snortsam? 
 
If you simply want to know about "dropped" packets relative to
processing stats... kill -USR1 <snortpidfoo> will dump that info
for you. 
 
Yes, you can run squil and base together... but they are certainly
different tools.... squil uses much more than just snort... as to
guides i would suggest NSMwiki.org 
 
Once you get squil running you simply add the configuration to your
by... no different than if you were dumping syslog and mysql with by.... 
 
JJC 
 
Joel Esler wrote:
<blockquote cite="mid:20080423175422.GC81457@Power-Mac.local"
type="cite">
<pre wrap="">I am going to do my best to not plug Sourcefire.

Sourcefire shows you when a packet has been dropped or not.

Did I do okay?

J

Lamanary Ramos de Pina said:
</pre>
<blockquote type="cite">
<pre wrap=""> Hi all,

I have a centos+snort+base ips set and is quite difficult to me to "see"
the results of the drops on BASE console. I understand that a sdrop
doesn't produce any alert but that's not what I want.

Is there anything like BASE (free or not) that runs over snort that gives
me a different feedback on the alerts, logs and drops namely?

I read something about sguil and i would like to know if is possible to
run it together with base? if yes, can you point me a good tutorial?

Yes, I admit that I haven't googled enough on this yet, I'm just asking
for a shotcut here.

Thanks
</pre>
</blockquote>
<pre wrap="">
</pre>
<blockquote type="cite">
<pre wrap="">-------------------------------------------------------------------------
This SF.net email is sponsored by the 2008 JavaOne(SM) Conference
Don't miss this year's exciting event. There's still time to save $100.
Use priority code J8TL2D2.
<a class="moz-txt-link-freetext" href="http://ad.doubleclick.net/clk;198757673;13503038;p?http://java.sun.com/javaone">http://ad.doubleclick.net/clk;198757673;13503038;p?http://java.sun.com/javaone</a>
</pre>
</blockquote>
<pre wrap="">
</pre>
<blockquote type="cite">
<pre wrap="">__________________________________________ _____
Snort-users mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Snort-users@lists.sourceforge.net">Snort-users@lists.sourceforge.net</a>
Go to this URL to change user options or unsubscribe:
<a class="moz-txt-link-freetext" href="https://lists.sourceforge.net/lists/listinfo/snort-users">https://lists.sourceforge.net/lists/listinfo/snort-users</a>
Snort-users list archive:
<a class="moz-txt-link-freetext" href="http://www.geocrawler.com/redir-sf.php3?list=snort-users">http://www.geocrawler.com/redir-sf.php3?list=snort-users</a>
</pre>
</blockquote>
<pre wrap="">

-----
joel esler
828A A216 6D95 A6BB B386 54F3 ACE3 B833 5F51 4902

-------------------------------------------------------------------------
This SF.net email is sponsored by the 2008 JavaOne(SM) Conference
Don't miss this year's exciting event. There's still time to save $100.
Use priority code J8TL2D2.
<a class="moz-txt-link-freetext" href="http://ad.doubleclick.net/clk;198757673;13503038;p?http://java.sun.com/javaone">http://ad.doubleclick.net/clk;198757673;13503038;p?http://java.sun.com/javaone</a>
_______________________________________________
Snort-users mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Snort-users@lists.sourceforge.net">Snort-users@lists.sourceforge.net</a>
Go to this URL to change user options or unsubscribe:
<a class="moz-txt-link-freetext" href="https://lists.sourceforge.net/lists/listinfo/snort-users">https://lists.sourceforge.net/lists/listinfo/snort-users</a>
Snort-users list archive:
<a class="moz-txt-link-freetext" href="http://www.geocrawler.com/redir-sf.php3?list=snort-users">http://www.geocrawler.com/redir-sf.php3?list=snort-users</a>
</pre>
</blockquote>
</body>
</html>

--------------010408070806080705000108--

--===============0180369227==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

-------------------------------------------------------------------------
This SF.net email is sponsored by the 2008 JavaOne(SM) Conference
Don't miss this year's exciting event. There's still time to save $100.
Use priority code J8TL2D2.
http://ad.doubleclick.net/clk;198757...un.com/javaone
--===============0180369227==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/...fo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.p...st=snort-users
--===============0180369227==--

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode