[ previous ] [ next ] [ threads ]
 From:  "Chad R. Larson" <clarson at eldocomp dot com>
 To:  Dirk Hombrecher <dhombrecher at ifrance dot com>, "m0n0wall at lists dot m0n0 dot ch" <m0n0wall at lists dot m0n0 dot ch>
 Subject:  Re: [m0n0wall] snort
 Date:  Wed, 26 Nov 2003 10:45:41 -0700
At 04:43 PM 11/25/2003, Dirk Hombrecher wrote:
>is it possible to add into m0n0wall an IDS like SNORT?

You might be able to get close by enabling the remote syslog feature and 
then running some of the log monitoring/analyzing tools on a different 
machine.  SNORT can take a pretty good bite out of your available CPU, 
which would be an issue on embedded systems like the Soekris boxes.

Or else, bridge a third interface to the WAN side and then use an external 
box to SNORT that.


This message is intended for the sole use of the individual and entity to whom it is addressed, and
may contain information that is privileged, confidential and exempt from disclosure under applicable
law. If you are not the intended addressee, nor authorized to receive for the intended addressee,
you are hereby notified that you may not use, copy, disclose or distribute to anyone the message or
any information contained in the message. If you have received this message in error, please
immediately advise the sender by reply email, and delete the message. Thank you.