Ethical Hacking

Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package.
Computer Forensics Training at InfoSec Institute

Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors.




Network Security Snort-Users
[Top] [All Lists]
<prev [Date] next>
[Advanced]
 <prev [Thread] next>

Re: [Snort-users] HELP: Dealing with 2 output plugin, is it ok?

from [Joel Esler] Network Security [Permanent Link]
Subject: Re: [Snort-users] HELP: Dealing with 2 output plugin, is it ok?
Date: Wed, 14 Nov 2007 22:56:26 -0500 
This should work fine.  I know of several people that do it.

Joel

On Nov 14, 2007, at 9:37 PM, Rachmat Hidayat Al-Anshar wrote:

Hi guys,

Reminding, I'm on my research deploying an IDS system with active response.
Because there is no 'clean' SnortSam patch yet for Snort-2.8.0, so I decided
to use snort-snortsam-2.7.0 pre-patched one. There is something that I've
to ask

Is it fine to use SnortSam output plugin (on snort mechine) together with
the unified output plugin? I need unified output plugin to work with Barnyard
and send the result to MySQL server to work with BASE-1.3.8 meanwhile I do need
the snortsam output plugin to send the bad IP address and have it blocked in
snortsam blocking agent that runs on firewall mechine?! any response will greatly
appreciated.

I need more explaination here...

Thanks in advance
~ Mat (^^) ~


Be a better pen pal. Text or chat with friends inside Yahoo! Mail. See how .-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems? Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >> http://get.splunk.com/_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users 

-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems?  Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >> http://get.splunk.com/
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
[More messages with this same subject...]




<Prev in Thread] Current Thread [Next in Thread>
Previous by Date:  [Snort-users] HELP: Dealing with 2 output plugin, is it ok?, Rachmat Hidayat Al-Anshar
Next by Date:  [Snort-users] Excluding a single host from a rule, Roman Daszczyszak
Previous by Thread:  [Snort-users] HELP: Dealing with 2 output plugin, is it ok?, Rachmat Hidayat Al-Anshar
Next by Thread:  [Snort-users] Excluding a single host from a rule, Roman Daszczyszak
Indexes:  [Date] [Thread] [Top] [All Lists]