On Wed, 7 Mar 2001, John P . Looney wrote:
> Did you have a look at snort ?
aye, snort seems rather nice. i didn't at all like the way portsentry
binds to everything when i tried it yonks ago. snort though is very
nice cause it is so stealthy and passive.
be interested in what plop has to say about it in light of his very
well balanced and informative post to this same thread. (one to link
to from the linux.ie front page?)
also, i need to look at whether snort can read from a file or else
whether it can do full logging in IDS mode. Basically, i want to be
able to run snort *and* also have a log file of traffic for analysis
with tcpstat. But it would be very silly to have 2 processes sniffing
the same stuff.
So i need to either run one tcpdump logging to a file, and have snort
and tcpstat reading that file. Or else have snort do full tcpdump
style logging and have tcpstats read that file.
Unfortunately in IDS mode snort only logs packets that match a rule...
if anyone has the answer handy let me know.
Maintained by the ILUG website team. The aim of Linux.ie is to
support and help commercial and private users of Linux in Ireland. You can
display ILUG news in your own webpages, read backend
information to find out how. Networking services kindly provided by HEAnet, server kindly donated by
Dell. Linux is a trademark of Linus Torvalds,
used with permission. No penguins were harmed in the production or maintenance
of this highly praised website. Looking for the
Indian Linux Users' Group? Try here. If you've read all this and aren't a lawyer: you should be!