RE: [cobalt-security] IDS and established TCP/UDP sessions

["Peter Baldwin" <peterj@xxxxxxxxxxxxxx>]

> Although I haven't installed it yet, Snort is where I'm most likely
> headed, but want to hear from you guys.

I haven't checked the RPMS on the snort site (they are a new addition).  We
built Snort RPMS for RaQs about 6 weeks ago ... not hard, but there are a
couple of gotchas.  http://vito.pointclark.net/cobalt/snort.html.

Just my $0.02 (since you asked for it!)  Snort, PortSentry, et al prevent
break-ins because they can help an administrator become more aware of what's
going on.  In other words, installing snort and just letting it run
unattended won't really help much.

SnortSnarf is handy
http://www.silicondefense.com/software/snortsnarf/index.htm

> If you don't know the PID, how do you kill an established TCP/UDP session
> w/o rebooting the box? All netstat does is show you the current activity.

The "-p" flag on netstat shows the process/PID (you must be root).

Cheers!
Pete

--------------------------
http://vito.pointclark.net
Vito - A Cobalt RaQ System Monitor