|
Home > Archive > Snort > September 2004 > [Snort-users] ACID with multiple Sensors?
You are viewing an archived Text-only version of the thread.
To view this thread in it's original format and/or if you want to reply to
this thread please [click here]
| Author |
[Snort-users] ACID with multiple Sensors?
|
|
| Bill Warren 2004-09-27, 5:47 pm |
| All,
I just got ACID, PHP, mysql installed on my Snort box. Then hit it hard
with Nessus to make sure that it works and it does. When I was reading
the results I saw that I could search multiple senors. So, my question
is how do I make multiple Snort boxes talk to each other?
Thanks,
Bill
--
**********************************
Bill Warren
Optivel, Inc.
E-mail: bwarren@optivel.com
Voice: 317.275.2305
Fax: 317.275.2301
Web: http://www.optivel.com
**********************************
-------------------------------------------------------
This SF.Net email is sponsored by: YOU BE THE JUDGE. Be one of 170
Project Admins to receive an Apple iPod Mini FREE for your judgement on
who ports your project to Linux PPC the best. Sponsored by IBM.
Deadline: Sept. 24. Go here: http://sf.net/ppc_contest.php
________________________________________
_______
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists...nfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf....ist=snort-users
| |
| Gould, Scott 2004-09-27, 5:47 pm |
| Bill,
Configure your multiple sensors to all log to the same MYSL database,
each with a different sensor ID or name. I have not done this without
using barnyard. But, in my experience in the past I had to manually
create the additional sensor entries in the sensor table in the MySQL
db, for each of the additional sensors. Things may have changed a
little, so someone may have something to add, as I am no longer using
this method myself. But, it did work in the past with this type of
layout.
7 snort sensors. Each running snort and barnyard. Each instance of
barnyard configured with a unique snort id to reference in the db,
sending alerts to a single mysql DB.
Scott Gould, MCP
Senior Network & Systems Analyst
Gynecologic Oncology Group=20
Statistical & Data Center
sgould@gogstats.org
716-845-5702
-----Original Message-----
From: snort-users-admin@lists.sourceforge.net
[mailto:snort-users-admin@lists.sourceforge.net] On Behalf Of Bill
Warren
Sent: Monday, September 27, 2004 9:25 AM
To: Snort-users@lists.sourceforge.net
Subject: [Snort-users] ACID with multiple Sensors?
All,
I just got ACID, PHP, mysql installed on my Snort box. Then hit it hard
with Nessus to make sure that it works and it does. When I was reading=20
the results I saw that I could search multiple senors. So, my question=20
is how do I make multiple Snort boxes talk to each other?
Thanks,
Bill
--=20
**********************************
Bill Warren
Optivel, Inc.
E-mail: bwarren@optivel.com
Voice: 317.275.2305
Fax: 317.275.2301
Web: http://www.optivel.com
**********************************
-------------------------------------------------------
This SF.Net email is sponsored by: YOU BE THE JUDGE. Be one of 170
Project Admins to receive an Apple iPod Mini FREE for your judgement on
who ports your project to Linux PPC the best. Sponsored by IBM.
Deadline: Sept. 24. Go here: http://sf.net/ppc_contest.php
________________________________________
_______
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists...nfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf....t=3Dsnort-users
-------------------------------------------------------
This SF.Net email is sponsored by: YOU BE THE JUDGE. Be one of 170
Project Admins to receive an Apple iPod Mini FREE for your judgement on
who ports your project to Linux PPC the best. Sponsored by IBM.
Deadline: Sept. 24. Go here: http://sf.net/ppc_contest.php
________________________________________
_______
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists...nfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf....ist=snort-users
| |
| Sean Brown 2004-09-27, 5:47 pm |
| On September 27, 2004 7:25 am, Bill Warren wrote:
> All,
>
> I just got ACID, PHP, mysql installed on my Snort box. Then hit it hard
> with Nessus to make sure that it works and it does. When I was reading
> the results I saw that I could search multiple senors. So, my question
> is how do I make multiple Snort boxes talk to each other?
>
> Thanks,
> Bill
I have snort running on a firewall, I configured 2 instances, on listening on
the internal interface and one on the external, they use different .conf
files so it would be the same as if they were on separate machines. Here is
the mysql line from each:
External:
output database: log,mysql,dbname=snort user=snorter host=192.168.1.2
port=3306 sensor_name=SPARTA_FW_EXT
Internal:
output database: log,mysql,dbname=snort user=snorter host=192.168.1.2
port=3306 sensor_name=SPARTA_FW_INT
As you can see all you have to do is point them at the same database and
assign each one a unique name, with the aptly named sensor_name.
-Sean Brown
-------------------------------------------------------
This SF.Net email is sponsored by: YOU BE THE JUDGE. Be one of 170
Project Admins to receive an Apple iPod Mini FREE for your judgement on
who ports your project to Linux PPC the best. Sponsored by IBM.
Deadline: Sept. 24. Go here: http://sf.net/ppc_contest.php
________________________________________
_______
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists...nfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf....ist=snort-users
|
|
|
|
|