Printable View
Hi Guys,
Has any member have experience with using snort?
What was you experience with using it, do you think it is useful and / any good / configuration learning curve.. etc?
My company has asked me to have a look at it and see if it would have any IDS benefits worth implementing.
I'm only in from work, just thought i'd get a bit of feed back before I delve in.
I like it. It can be a little difficult to get up and running from the start, but once you get it, it's very useful. I'm currently working on a project where I'm putting remote snort sensors in 5 different sites, they will share the same database at the main site.Quote:
Originally Posted by SBerry
I'm not sure when the new version is due out, but the new version is supposed to be an IPS instead of just an IDS.
Heh, my smoothwall uses snort for ids, that then blocks ip's based on different rules. It decided my dns servers were evil and blocked them. Took me a few minutes to figure out why I could ping my dns servers but not go to Google... :rolleyes:Quote:
Originally Posted by streaker69
Sounds good,
Just after taking a look at the website. There is plenty of info to get me started.
You see at the moment the security is adequate, however there is no port security enabled on any of the network switches (Sticky or whatever), the staff are permitted to bring in their own development laptops and connect to the network. There are however, ACL in place to limit inter VLAN comms.
But just as a logging mechanism to catch any strange happenings, I thought maybe it would be beneficial. Just really want to know is it worth the time and effort setting it up?
Thanks for the input streaker69
EDIT: Just cam across this http://www.uno-code.com/?q=node/59
DNS is evil. People should be forced to remember websites by IP only.Quote:
Originally Posted by Barry
Yuck... layer 2 security is IME one of the least defended.Quote:
Originally Posted by SBerry
I concur with that 100%Quote:
Originally Posted by streaker69
Also, be sure to use / tweak the Emerging Threats rules.
I use snort too, and agree with the above posts - it's a good IDS, easy to configure, easy to use afterwards. It can be an IPS too, by blocking offending IPs (yeah, of DNS servers to,... but I remember there was a checkbox preventing that somewhere).
Depends on the ips. I had to white list my dns servers, I also had to white list the Intiut servers, all the sudden our financial software wasn't getting updates... oops!Quote:
Originally Posted by xorred
There's a LiveCD out now:Quote:
Originally Posted by streaker69
Security Onion: The Security Onion LiveCD is now available!
Check it out.
Maybe it's just me, but I enjoy installing things from source. I've found it the best way to learn.Quote:
Originally Posted by hawaii67