[Snort-users] General snort question

Matt Kettler mkettler at ...4108...
Fri Sep 10 12:41:01 EDT 2004


At 03:31 PM 9/10/2004, Wendell Smith wrote:
>So I have just installed Snort/Acid on a test server of mine and for the
>most part, I'm really enjoying the functionality these two apps provide.
>I would like to deploy this IDS on my WAN exposed servers.
>
>My question to the list is:
>
>Can I do this in a way such that I don't have to install Snort, Acid,
>Apache, PHP, MySQL, etc on each of these WAN exposed machines.

Do you really need or even want separate collections per server?
Are your wan exposed servers all in their own subnet (ie: all in one DMZ)?

In general I'd just use a managed switch for the DMZ, and configure a span 
port to monitor the link up to your firewall or router. Run the span to a 
snort box and sniff the whole subnet's internet traffic all at once.

If you've got a couple DMZs, you can add extra interfaces to your snort box 
and just run multiple instances of snort on the same machine, or use 
bonding to bond the interfaces and have a single snort use the bonded 
interface.







More information about the Snort-users mailing list