spoppi at gmx.de
| Revision History | ||
|---|---|---|
| Revision 1.0 | 2002-01-01 | Revised by: sp |
| - first release version - moved to snort version 1.8.3 - changed RPMS to point to www.snort.org - added link for my snortd initscript - added warning about automatic rule update - added hint to IDSPM - changed for rule files to /etc/snort to reflect snort.org's RPMS - as allways: claryfied some parts | ||
| Revision 0.05 | 2001-11-14 | Revised by: sp |
| - renamed HOWTO to Snort-Setup for Statistics HOWTO - added short statistic script which I was inspired by Greg Sarsons - clarified some parts and corrected some typos | ||
| Revision 0.04 | 2001-09-29 | Revised by: sp |
| - added section "snort internal statistics" suggested from Greg Sarson - added short statistic script contributed by Greg Sarson but commented it out to get a more general version | ||
| Revision 0.03 | 2001-09-19 | Revised by: sp |
| - added throttle option to swatch.conf - changed ACID to version 0.9.6b15 - added some comments in ACID section - added MD5 checksum section but commented it out | ||
| Revision 0.02 | 2001-09-16 | Revised by: sp |
| Some clarifications as suggested from Greg Sarsons, thx ;) | ||
| Revision 0.01 | 2001-09-04 | Revised by: sp |
| Initial version | ||
This HOWTO describes how to configure Snort version 1.8.3 to be used in conjunction with the statistical tools ACID (Analysis Console for Intrusion Databases) and SnortSnarf. It also intends to get some internal statistics out of snort, e.g. if there are packets dropped.
Additionally a description of how to automatically update Max Vision's rules, some scripts which may be helpful and a demo swatch configuration is included.
| Next | ||
| Introduction |