[Snort-users] About to setup snort
Truax, Shawn (MBS)
Shawn.Truax at ...8509...
Thu May 20 20:10:59 EDT 2004
You might run into some issues with those HUBs. Depending on the amount of
traffic you have on your network you may run into some heavy collision
situations. Before you go all crazy and install the whole solution I would
put in one of the HUBs and see how things run for a day or so. If users
start calling up complaining about performance or connectivity you may have
to invest in some taps or switchs that have span ports. Another option for
you may be the Do-It-Yourself Tap instructions on the Snort Website. If
you have trouble with the Hubs try those. I wouldn't recommend them for
high traffic areas but they may be good enough for you and get you somewhere
that is better than a HUB but cheaper then the new switches.
155 University Ave.
From: Shaun T. Erickson [mailto:ste at ...11690...]
Sent: May 20, 2004 4:58 PM
To: Snort-users at lists.sourceforge.net
Subject: [Snort-users] About to setup snort
I'm about to embark on seting up snort on our networks. The plan is to
have a number of sensors (3) that outputs alerts, and related logged
packets, in unified format. Each sensor would also run barnyard, to pick
up the logged alerts and packets and send them to a central server, for
analysis. The central server would have a mysql database with an acid
front-end. I've heard that acid doesn't send alerts (I could be wrong),
so the plan would be to have an additional (as yet undetermined) program
access the database and send out email/pager alerts as needed. It's also
hoped that the mysql/acid setup could also receive, store and process
syslog information coming from two sonicwall firewalls and an iptables
firewall, and alert us as needed, based on that information, as well.
Our networks are small, and with a small number of servers and clients.
Until such a time as we can afford switches that support a monitoring
port, we are replacing our 100Mb switches with 100Mb hubs, so that we
can get access to all the traffic. Each sensor will be plugged into the
network it's to monitor, twice - once for normal access to the sensor,
via ssh, for the sensor to send it's data to the central server, etc.,
and once with a nic in promiscuous mode for capture purposes.
Does this all sound reasonable?
Another question: One sensor will be running on FreeBSD. I see there is
a port for snort, but I cannot find one for barnyard. Is there one? The
other sensors will be running on (for the moment) Red Hat 8 and Red Hat
Advanced Server 2.1 (I'm forced to run my sensors on existing servers,
for the time being. Later, I'll be allowed to by dedicated systems.) Are
there RPMS for the latest versions of snort and barnyard for those two
platforms? My central server is dedicated, btw.
I'm to embark on this tomorrow. Any insights/advice and so on is most
This SF.Net email is sponsored by: Oracle 10g
Get certified on the hottest thing ever to hit the market... Oracle 10g.
Take an Oracle 10g class now, and we'll give you the exam FREE.
Snort-users mailing list
Snort-users at lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
Snort-users list archive:
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Snort-users