
	Home > Security Channel Tips > Snort Report > Output options for Snort data

Security Channel Tips:

EMAIL THIS

TIPS & NEWSLETTERS TOPICS

Output options for Snort data

Richard Bejtlich
Rating: --- (out of 5)

Output modes are the methods by which Snort reports its findings when run in IDS mode. As discussed in the first Snort Report, Snort can also run in sniffer and packet logger modes. In sniffer mode, Snort writes traffic directly to the console. As a packet logger, Snort writes packets to disk in Libpcap format. This article describes output options for IDS mode, called via the -c [snort.conf] switch. Only IDS mode offers output options.

This is the first of two Snort Reports in which I address output options. Without output options, consultants and VARs can't produce Snort data in a meaningful manner. Because output options vary widely, it's important to understand the capabilities and limitations of different features. In this edition of Snort Report, I descri...

RELATED CONTENT

	Open Source Security Tools
	Using SnortSP and Snort 2.8.2
	OSSEC Host-Based Intrusion Detection Guide
	How to find new features in Snort 2.8.2
	How to use shared object rules in Snort
	Snort frequently asked questions
	How to test Snort
	How to run IDS Snort on Red Hat Enterprise Linux 5
	Working with Snort's unified output
	Snort IDS installation basics and tips for security resellers
	Snort IDS upgrade and tips on the Snort.conf file

Network Security

Network security services issues to watch out for in 2010

Getting to know the change control technology on the horizon

How to help customers choose a network access control product

Offering SaaS for securing mobile devices

How to perform a network security audit for customers

Cracks in WPA? How to continue protecting Wi-Fi networks

Host-based IDS/IPS Partner Program Directory

Network security algorithms introduction

Searching for multiple strings in packet payloads

Approximate string matching

Open Source Security Software

Network session data analysis with Snort and Argus

How to use shared object rules in Snort

Why is the Snort IDS still alive and thriving?

Is Snort right for the IDS needs of all clients?

What is the difference between Snort and Bro?

How can the operator test Snort?

What does the future hold for Snort?

What extra functionality do Snort add-ons provide?

Does Snort support target-based intrusion detection?

Will deploying Snort detect malicious events quickly?

RELATED RESOURCES

2020software.com, trial software downloads for accounting software, ERP software, CRM software and business software systems

Search Bitpipe.com for the latest white papers and business webcasts

Whatis.com, the online computer dictionary

be output options available from the command line and their equivalent options (if available) in the snort.conf file. I don't discuss the Unix socket option (-A unsock or alert_unixsock). I will conclude with a description of logging directly to a MySQL database, which I don't recommend but explain for completeness.

Preparation

Running Snort in IDS mode requires changes to the snort.conf file (here called snort.conf.2.6.1.4) in order to enable various options. The following diff (a Unix program that shows changes between two files) shows the changes between the snort.conf file shipping with Snort 2.6.1.4 and my configuration file called snort.conf.2.6.1.4.

Read part 2, Command line output modes

Rate this Tip

To rate tips, you must be a member of SearchSecurityChannel.com.
Register now to start rating these tips. Log in if you are already a member.

DISCLAIMER: Our Tips Exchange is a forum for you to share technical advice and expertise with your peers and to learn from other enterprise IT professionals. TechTarget provides the infrastructure to facilitate this sharing of information. However, we cannot guarantee the accuracy or validity of the material submitted. You agree that your use of the Ask The Expert services and your reliance on any questions, answers, information or other materials received through this Web site is at your own risk.

SEARCH

TechTarget provides technology professionals with the information they need to perform their jobs - from developing strategy, to making cost-effective purchase decisions and managing their organizations' technology projects - with its network of technology-specific websites, events and online magazines.


TechTarget Corporate Web Site \| Media Kits \| Site Map All Rights Reserved, Copyright 2006 - 2010, TechTarget \| Read our Privacy Policy