[small] article on trisentry

[Testin da Cable]

http://www.onlamp.com/pub/a/onlamp/2002/11/14/trisentry.html

short version:
track [and block] tcp and udp connections
scan your logs for <defined> events
track user's logins with a database

unix-alikes only soz

 

[Will]

I'll learn to walk before I start running, I feel.

 

[Testin da Cable]

*trip itchy*

 

[xane]

He needs to get off his fat arse first.

So, how is this different from SNORT ?

 

[Will]

FAT? FAT?!!??!!??

Makes a nice change from mal-nourished skinny boy I guess.

 

[Testin da Cable]

ring.alphanor.org snort: [1:485:2] ICMP Destination Unreachable (Communication Administratively Prohibited) [Classification: Misc activity] [Priority: 3]: {ICMP} xxx.xxx.xxx.xxx -> 62.216.9.68

mmm snort doesn't allow you to block on evil activity iirc. it may though, but I take other steps to prohibit that. I personally use snort to quantify.

 

[Wilier]

I understood all of that.

 

[Will]

Failed