[Snort-users] OT - Demarc setup with remote sensor

Jeff Newton Jeff_Newton at ...4280...
Thu Jan 24 11:29:02 EST 2002


I've got one PC running a snort on 3 different interfaces.  On another
PC, I'm running mysqld and Demarc/PureSecure.  I've got the PureSecure
console
up and running as well as snort logging to mysql.  I see the logged
alerts in the console.

Under the configure tab of PureSecure, Sensor details indicate that SID
1-3 are assigned to each sensor interface but that "Rules have never
been implemented on host. Client possibly not running?".

I want to be able to use the console to modify rules, etc. on the remote
sensor.  How do I do this?  The installation doc talks about installing
and running the client.  I did put PureSecure on the remote sensor but
when I run /usr/sbin/demarcd ? it complains that it cannot connect the
DB at 127.0.0.1.  This is correct, the DB is on another machine.

Can anyone help with the configuration.  

Cheers,

-- 
Jeff Newton




More information about the Snort-users mailing list