Re: Snort Enterprise Implementation

[Jens Krabbenhoeft <tschenz-snort-users () noris net>]

Greg,

> recorded for the fields TCP, UDP, ICMP  of the Analysis Console for
> Intrusion Databases (ACID); however, the precent for Portscan Traffic
> remains at zero ACID.

You have to point ACID to your scan.log file in the config:

/* Snort spp_portscan log file */
$portscan_file = "";

The problem is, that the portscan data isn't normalized into the
database structure and remains in a plain file. I don't know if
IDScenter is syncing files between the IDS box and the ACID box. If not,
try to find a solution how to sync the portscan log onto the acid box
(rsync, scp, ftp, ...).

HTH,
        Jens


-------------------------------------------------------
This SF.NET email is sponsored by: FREE  SSL Guide from Thawte
are you planning your Web Server Security? Click here to get a FREE
Thawte SSL guide and find the answers to all your  SSL security issues.
http://ads.sourceforge.net/cgi-bin/redirect.pl?thaw0026en
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users