Re: [cobalt-security] IDS and established TCP/UDP sessions

[Michael Stauber <cobalt@xxxxxxxxxxxxxx>]

Hi Mike,

> Although I haven't installed it yet, Snort is where I'm most likely
> headed, but want to hear from you guys.

Snort is really worth it. But you also should get Demarc 
(http://www.demarc.org). It is a web frontend to Snort and uses MySQL to 
store Snorts reports. You'll then get nifty reports and statistical 
breakdowns of what's going on.

Of course you need to build Snort with MySQL support to make it interface 
with Demarc. The Demarc docs tell you how to do that. AFAIK the RPMs for 
Snort do not come with MySQL support, but it's easy to compile.

-- 

With best regards,

Michael Stauber
SOLARSPEED.NET