Snort-Setup for Statistics HOWTO

Sandro Poppi

        spoppi at

Revision History
Revision 1.0 2002-01-01 Revised by: sp
- first release version - moved to snort version 1.8.3 - changed RPMS to point to - added link for my snortd initscript - added warning about automatic rule update - added hint to IDSPM - changed for rule files to /etc/snort to reflect's RPMS - as allways: claryfied some parts
Revision 0.05 2001-11-14 Revised by: sp
- renamed HOWTO to Snort-Setup for Statistics HOWTO - added short statistic script which I was inspired by Greg Sarsons - clarified some parts and corrected some typos
Revision 0.04 2001-09-29 Revised by: sp
- added section "snort internal statistics" suggested from Greg Sarson - added short statistic script contributed by Greg Sarson but commented it out to get a more general version
Revision 0.03 2001-09-19 Revised by: sp
- added throttle option to swatch.conf - changed ACID to version 0.9.6b15 - added some comments in ACID section - added MD5 checksum section but commented it out
Revision 0.02 2001-09-16 Revised by: sp
Some clarifications as suggested from Greg Sarsons, thx ;)
Revision 0.01 2001-09-04 Revised by: sp
Initial version

This HOWTO describes how to configure Snort version 1.8.3 to be used in conjunction with the statistical tools ACID (Analysis Console for Intrusion Databases) and SnortSnarf. It also intends to get some internal statistics out of snort, e.g. if there are packets dropped.

Additionally a description of how to automatically update Max Vision's rules, some scripts which may be helpful and a demo swatch configuration is included.

Table of Contents
1. Introduction
1.1. Copyright Information
1.2. Disclaimer
1.3. New Versions
1.4. Credits
1.5. Feedback
1.6. Translations
2. Structure
3. Technical Overview
4. Configuration
4.1. Configuring Snort
4.2. Configuring MySQL
4.3. Configuring ADODB
4.4. Configuring PHPlot
4.5. Configuring ACID
4.6. Configuring SnortSnarf
4.7. Configuring Arachnids_upd
4.8. Configuring Swatch
5. Security Issues
6. Getting Help
7. Questions and Answers