Re: Prelude and Sguil capabilities

On Tue, 2006-11-21 at 12:20 +0100, Robin Gruyters wrote:
> Quoting Yoann Vandoorselaere <[email protected]>:
> 
> > On Tue, 2006-11-21 at 11:26 +0100, Robin Gruyters wrote:
> >> Quoting Yoann Vandoorselaere <[email protected]>:
> >>
> >> > On Tue, 2006-11-21 at 10:57 +0100, Robin Gruyters wrote:
> >> >> Quoting Yoann Vandoorselaere <[email protected]>:
> >> >>
> >> >> > On Tue, 2006-11-21 at 10:02 +0100, Robin Gruyters wrote:
> >> >> >> Quoting Yoann Vandoorselaere <[email protected]>:
> >> >> >> > On Fri, 2006-11-10 at 16:42 +0100, Robin Gruyters wrote:
> >> >> >> >> - Save full packets in tcpdump format; (which we already have
> >> >> >> >>   up-and-running)
> >> >> >> >
> >> >> >> > Modifying Snort so that it attach the full packet data, and having
> >> >> >> > Prewikka able to print the headers (as is currently done, but
> >> >> >> > differently) potentially sound like a good idea.
> >> >> >> >
> >> >> >> > Did you actually tried it? If you did, I'd like to hear about it.
> >> >> >> >
> >> >> >> Well like I said, we already have this done, but we have done it with
> >> >> >> tcpdump(8) not with Snort. I don't like the idea to use Snort for
> >> >> >> Alerts as well for full packet logging. (e.g. security issues with
> >> >> >> Snort)
> >> >> >
> >> >> > Could you elaborate ?
> >> >> >
> >> >> Well in the past we had some issues with Snort that it just dies, with
> >> >> no error messages. If you use Snort for Alerts and for full packet
> >> >> logging, then both processes will die, so you don't have *any* alerts
> >> >> or packet logging. That for me is a big no, no.
> >> >
> >> > How did it die exactly?
> >> >
> >> At the moment I haven't found the problem, yet.
> >
> > I mean was it a crash, did it froze, did it exit? What was the Snort
> > version?
> >
> It died (crash) and it was with Snort version 2.6.0.2 on FreeBSD 5.4.  
> At the moment we have FreeBSD 6.1, but until now no Snort process has  
> died.

It would be nice if you could try to reproduce the problem under GDB,
and post a backtrace when the problem reproduce.

Thanks!

-- 
Yoann Vandoorselaere <[email protected]>

_______________________________________________
Prelude-devel site list
[email protected]
http://www.prelude-ids.org/mailman/listinfo/prelude-devel