[Snort-users] Newbie Question..

Edwin Pua edwin1118 at ...125...
Tue Jan 15 22:37:08 EST 2002


Hi John,

Thanx for the clarification.

Btw, i would like to view the logs properly in my snort box using some 
statistical tools like ACID and SnortSnarf. Is possible to run these tools 
in the same snort box just for testing? I am afraid that it would conflict 
to some snort config files.

Any suggestion?


>From: John Sage <jsage at ...2022...>
>To: Edwin Pua <edwin1118 at ...125...>
>CC: bmc at ...950..., snort-users at lists.sourceforge.net
>Subject: Re: [Snort-users] Newbie Question..
>Date: Tue, 15 Jan 2002 21:17:47 -0800
>
>Edwin:
>
>It seems you're specifying the full path to your snort rules with
>/etc/snort/ddos.rules etc etc...
>
>That should work just fine.
>
>The default syntax in snort.conf assumes that when snort is invoked, it
>will find snort.conf in the directory which also contains the rules, so
>really it's not necessary to specify the path to the rules in
>snort.conf, but there shouldn't be any harm in doing so...
>
> >  How will i enable my snort rules to communicate with snort.conf file
> > and run in NIDS mode?
>
>hmm.. not sure what you mean by this: I'd say that snort.conf needs to
>know where to find the rules, but the rules don't communicate with
>snort.conf, so much as with snort itself...
>
>
>The basic NIDS command line is:
>
>snort -dev -l ./log -h 192.168.1.0/24 -c snort.conf
>
>See: SNORT_USAGE which gets posted to this list once a week...
>
>
>
>HTH..
>
>
>- John
>
>--
>The web page you seek
>cannot be found here:
>countless others await


_________________________________________________________________
Chat with friends online, try MSN Messenger: http://messenger.msn.com





More information about the Snort-users mailing list