Contents

xi

4.2.1

Unified Logging Output Module 

153

4.2.1

SNMP Traps Output Module 

154

4.2.1

Log Null Output Module 

155

4.3 Using BPF Fileters 

155

4.4 References 156

 Chapter 5   

Using Snort with MySQL 

157

5.1 Making Snort Work with MySQL 

160

5.1.1

Step 1: Snort Compilations with MySQL Support 161

5.1.1

Step 2: Install MySQL 

161

5.1.1

Step 3: Creating Snort Database in MySQL 

161

5.1.1

Step 4: Creating MySQL User and Granting

Permissions to User and Setting Password 

163

5.1.1

Step 5: Creating Tables in the Snort Database 164

5.1.1

Step 6: Modify snort.conf Configuration File 170

5.1.1

Step 7: Starting Snort with Database Support 171

5.1.1

Step 8: Logging to Database 

172

5.2 Secure Logging to Remote Databases Securely

Using Stunnel 

174

5.3 Snort Database Maintenance 

175

5.3.1

Archiving the Database 

175

5.3.2

Using Sledge Hammer: Drop the Database 

176

5.4 References 176

 Chapter 6   

Using ACID and SnortSnarf with Snort 

177

6.1 What is ACID? 

178

6.2 Installation and Configuration 

179

6.3 Using ACID 

184

6.3.1

ACID Main Page 

188

6.3.2

Listing Protocol Data 

189

6.3.3

Alert Details 

191

6.3.4

Searching 192

6.3.5

Searching whois Databases 

197

6.3.6

Generating Graphs 

198

6.3.7

Archiving Snort Data 

198

6.3.8

ACID Tables 

201

6.4 SnortSnarf 202

6.5 Barnyard 207

6.6 References 207