[Snort-users] PLEASE HELP HERE.
mikemorgan at ...468...
Mon Feb 9 06:43:09 EST 2004
"Can we use snort to monitor using
span r mirror port in the switch"
Dual NIC's, one passive on the hostile network and one on a trusted LAN for admin purposes, and yes, use a span/mirror port.
configure the admin NIC on the trusted lan and use SSHd with RSA authentication.
3.LOGS Where should i store all the logs.
A central MySQL server.
Use snort center and ACID
My reccomendation is look at www.sentinix.org and try it on a test machine, if you like what you see, proceed with your implementation.
From: vasanth b <vasanthjobs at ...125...>
Sent: Feb 8, 2004 9:59 PM
To: snort-users at lists.sourceforge.net
Cc: ravivsn at ...9637..., pauls at ...6838..., patrick at ...4250...
Subject: [Snort-users] PLEASE HELP HERE.
I will be implementing IDS using SNORT in our company network infrastructure
and would be thankfull for some help.After going through all the documents
found in snort.org.I have got some doubts in implementing Snort IDS.
Is this sensors r taps compulsory.Can we use snort to monitor using
span r mirror port in the switch.If sensor necessary where to get it and how
to place it.
And taps too i found different kinds of taps in the net so plz advice me in
2.EVENT MONITORING How to better configure the IDS NIC that will be acting
as an admin interface, where I will be connecting for event information.
Should I configure this interface with security to be accessed from the
Internet or should I configure this interface to be accessed from the LAN
via the firewall?
3.LOGS Where should i store all the logs.Should i need a separate server
to store all the logs.If not approximately how much space will be required.
4.REPORTING What is the best way to centralize and access all event
reporting? What is the best product to accomplish this?
Please be kind to let me know if you have a better approach to any of this
or if you have any other comments or suggestions.
ADVANCE THANKS FOR ALL WHOEVER HELPS AND GIVES THEIR VALUABLE IDEAS.
Gifts for Him & Her. Valentines Day. http://go.msnserver.com/IN/42197.asp
At MSN Shopping.
The SF.Net email is sponsored by EclipseCon 2004
Premiere Conference on Open Tools Development and Integration
See the breadth of Eclipse activity. February 3-5 in Anaheim, CA.
Snort-users mailing list
Snort-users at lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
Snort-users list archive:
More information about the Snort-users