*very* many snort installations..

[Mokum <snort () meij net>]

Greetings,

I was requested to look into the possibility to install snort as a 
service on 'all' [XP only] workstations [*way* over 10.000] of a very 
large, very global organization.

The goal is to have a better insight in the 'known bad' data flows 
though out the network. Of course, the main parts of the network are 
already IDS'ed so the workstation installation would be a sort of 
extended sensorium to make sure we see things behind the routers, 
switches, nat'ing devices & firewalls that normally go undetected untill 
things go really really wrong.

The well known pitfalls of rollouts like these that I am aware of are:
- the managebility:
      - collection of events
      - the number of the events

- the QA
      - snort.exe
            - stability of the service
            - resources needed
      - quality of the rules implemented

Not my problem is:
- the installation & distribution of the service, this is done for about 
1000 other applications too.
- the updating of the rules [is part of the distribution]

My question is if anybody on the list has expirience [good or bad] with 
a concept like this? Any pointers?

Cheers,
mokum




-------------------------------------------------------
This SF.net email is sponsored by: SF.net Giveback Program.
Does SourceForge.net help you be more productive?  Does it
help you create better code?  SHARE THE LOVE, and help us help
YOU!  Click Here: http://sourceforge.net/donate/
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users