El dom, 19 de 12 de 2004 a las 16:15, Klemen Mihevc escribiÃ:
now i have a problem couse every packet is logged (and logs are huge)
even if it's only about 1k big and it is product of outside scan of
server not actual connection to it. Is there anyway to log only first
and last package from 1 ip and only if data transfer is bigger then
let's say 5k? Or maybe anyother way to log that connections? I also
tryed with chaosreader & tcpdump but this method is too much cpu & ram
consuming and i also tried with iptable but again with same problem
(every package is logged). I relay wanna use snort because i can use
mysql & acid for statistic...
I propose you two solutions:
1) Use just iptables (maybe this doesn't suit you because you want acid
for the stats, storing the logs in mysql it's not a problem using ULOGD)
and the connection tracking system. Use some general rules to accept
the ESTABLISHED and RELATED traffic in the chains you want to use and
then use a rule with --state NEW to log only the initial connections.
2) Use a mixed solution. You need almost the same iptables rules I
have indicated above, but you can use snort-inline and the QUEUE
feature of iptables to pass the packets to snort-inline. Then use
the rules you have in snort-inline to just log the packets to mysql
and then use Acid to see the results.
Hope it helps.
--
Jose Maria Lopez Hernandez
Director Tecnico de bgSEC
jkerouac@bgsec.com
bgSEC Seguridad y Consultoria de Sistemas Informaticos
http://www.bgsec.com
ESPAÃA
The only people for me are the mad ones -- the ones who are mad to live,
mad to talk, mad to be saved, desirous of everything at the same time,
the ones who never yawn or say a commonplace thing, but burn, burn, burn
like fabulous yellow Roman candles.
-- Jack Kerouac, "On the Road"
-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://productguide.itmanagersjournal.com/
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
