[Snort-users] Re: Snort and Mysql for statistics purposes
Olaf Gellert
og at ...6508...
Wed Mar 9 16:59:03 EST 2005
David Jiménez Domínguez wrote:
> Do you think it is the best way to do that???
> Have your ever done something like that?? What tools do you recommend me??
Well, we have done exactly the same (our Sensor
is not Snort but Prelude, but the database is
MySQL), we are doing stats on a different
level (not port numbers etc), but the statistics
are generated using Perl and rrdtools:
http://www.ecsirt.net/service/ids-sensor-data.html
There are some other teams doing the same, for example
http://www.honeypots-alliance.org.br/stats/flows/all/
http://www.switch.ch/security/services/IBN/
http://www.jpcert.or.jp/isdas/
A collection of links to incident and IDS statistics
can be found at:
http://www.ecsirt.net/service/statistics.html
Cheers, Olaf
--
Dipl.Inform. Olaf Gellert PRESECURE (R)
Senior Researcher, Consulting GmbH
Phone: (+49) 0700 / PRESECURE og at ...6508...
A daily view on Internet Attacks
https://www.ecsirt.net/sensornet
More information about the Snort-users
mailing list