[Snort-users] Tao of doing it right: Ignoring bad advice and doing it the Bilano way!

Richard Bejtlich taosecurity at ...11827...
Tue Feb 22 17:20:05 EST 2005


On Tue, 22 Feb 2005 12:53:50 -0800,
snort-users-request at lists.sourceforge.net
<snort-users-request at lists.sourceforge.net> wrote:
 > See, at first I decided I would use this Squil IDS thing but that crazy
> Russian guy that wrote down the docs said I needed to keep every packet
> in a database (who has time for being a packet rat like that?) to make
> sure I don't get hackered by the nerds! Well that makes a whole hell of
> a lot of sense! If you keep them online in a database and you get hacked
> then the hacker will be able to just copy and paste them packets and
> whammo! Instant replay attack! Maybe I should I gift wrap them too?
> Smart thinking there you Bolshevik dundernuts! First Northcut drops his
> drawers at SANS and now this Betjitch guy wants to pinch it off for the
> hackers! His book should be called Tao of Network Reach-arounds!
> 

This is funny.  Russian is close, but I think my heritage lies a
little farther west of Moscow.  :)

Sguil does try to log packets to collect full content data, but never
to a database Billy boy!  That's Silent Runner, not Sguil.

I'm glad you liked my book.  I'm working on a sequel you'll love.

Richard Bejtlich
http://www.taosecurity.com




More information about the Snort-users mailing list