[Snort-users] Snort to monitor several servers

Gene R Gomez gene at ...13522...
Tue Dec 6 13:42:25 EST 2005


Jacob,

> How would you compare Snort to Samhain?
> Can't Snort do the same?

Eh...not really.  The focus is different.  Snort detects intrusions by
reviewing network data.  Samhain (and other HIDS in general) detect
intrusions by reviewing data on the local system.  Samhain in particular
is a File Integrity Checker, meaning it detects changes in files and
configurations on the local system.
There are other host-related methods for determining intrusion, as well. 
Prelude-LML, for example, is a log parser that looks for anamalous events
in flatfile and syslog streams.
So, the technologies are really complementary.  If you deploy Snort in a
few key locations to cover the network traffic, you can then deploy HIDS
and hopefully detect things you wouldn't have seen with Snort (for
example, HTTP exploits running within SSL sessions which you can detect
via something like mod_security).
Since Snort is network-centric, it really is more efficient to have a few
deployments in key locations, and supplement detection with host-based
solutions.

- Ramon




More information about the Snort-users mailing list