[Snort-devel] New demarc version.

Paul Accosta paco at ...1602...
Thu Nov 7 05:20:06 EST 2002


Not exactly now you can have snort 1.9 and 1.8 sensors writing to the
same database and while you have to restart each sensor if you update
the db shcmea you don't have to have all sensors on your network not
working while you install the new snort on each one. That was my read on
the doc anyway. This was a very big help for me since I decided to keep
the Solaris sensors version 1.8. because they segfault with the 1.9
Stream4 preprocessor

Paul

--
The flow chart is a most thoroughly oversold piece of program
documentation.
                -- Frederick Brooks, "The Mythical Man Month"



-- Original Message -------------
Subject: Re: [Snort-devel] New demarc version.
From: "Ian Macdonald" <secsnortdev at ...1490...>
Date: Tue, November 5, 2002 7:58 pm
To: "Paul Accosta" <paco at ...1602...>,
<snort-devel at lists.sourceforge.net>

I wonder how much value there is to this, since you have to kill all
your sensors and upgrade the schema then restart them even with this
mod. The only advantage is that you don't have to change the sensor
code.

Interesting, thanks for pointing this out.

Ian
----- Original Message -----
From: "Paul Accosta" <paco at ...1602...>
To: <snort-devel at lists.sourceforge.net>
Cc: <secsnortdev at ...1490...>
Sent: Tuesday, November 05, 2002 7:05 PM
Subject: Re: [Snort-devel] New demarc version.


>
> I thouht so too, and asked ther support, and they pointed me to the
file for the changes http://www.demarc.com/downloads/other/snort-db.txt
>
> It sais that it works for both 1.8 and 1.9 db schema so that sensors
are alwaqys running when upgrading. and tells you how to update to 1.9
db schema when all the sensors are running the 1.9.
>
> Paul
>
> --
> Cleaning your house while your kids are still growing is like
> shoveling the walk before it stops snowing.
>                 -- Phyllis Diller
>
>
>
> -- Original Message -------------
> Subject: [Snort-devel] New demarc version.
> From: <secsnortdev at ...1490...>
> Date: Mon, November 4, 2002 11:01 am
> To: <snort-devel at lists.sourceforge.net>
>
> Just thought I would mention that demarc has a new version of there
software online. It mmm supports 1.9. However after installing it I
realised that they are either using a beta version or the 1.9.0 with out
the 106 db schema since it is still using 105. Just a warning if you
hear people having problems using the stock 1.9.0 with demarc.
>
> Ian
>
>
>
> -------------------------------------------------------
> This sf.net email is sponsored by: See the NEW Palm
> Tungsten T handheld. Power & Color in a compact size!
> http://ads.sourceforge.net/cgi-bin/redirect.pl?palm0001en
> _______________________________________________
> Snort-devel mailing list
> Snort-devel at lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/snort-devel
>
>
>



-------------------------------------------------------
This sf.net email is sponsored by: See the NEW Palm
Tungsten T handheld. Power & Color in a compact size!
http://ads.sourceforge.net/cgi-bin/redirect.pl?palm0001en
_______________________________________________
Snort-devel mailing list
Snort-devel at lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-devel








More information about the Snort-devel mailing list