[Snort-users] Multiple sensors
arrison at ...5001...
Wed Mar 6 04:41:02 EST 2002
I currently have a single snort box sniffing our network uplink and logging
alerts to a mysql database on the same machine. I'd like to setup other
sensors on different VLANs in our network but keep alerting somehow
centralized. Do you suggest that I:
a) Use a remote mysql database connection to send the alerts back to the
original mysql database
b) Is there some built in snort connectivity to gather alerts?
c) Log locally and cron up a mysqldump every hour or so (ewww, this is an
Things to consider:
a) I'd prefer to keep only one set of rules, rather than different
snort.conf etc... on each sniffer.
b) If necessary, I can directly connect the multiple sniffers with a
All suggestions welcome. Thanks.
More information about the Snort-users