- Number of packets that Snort receives from one destination only
- Number of packets that Snort receives from all senders
- The time between two received packets
I'm not sure why you'd need to collect "the time between two received packets." Snort doesn't keep a record of...
By submitting your email address, you agree to receive emails regarding relevant topic offers from TechTarget and its partners. You can withdraw your consent at any time. Contact TechTarget at 275 Grove Street, Newton, MA.
every received packet unless you specifically instruct it to do so. Under Snort's primary settings, you consequently wouldn't be able to determine the time difference between two arbitrary packets. Tools like tcpdump run on the host, however, and should be able to address this third area.
Snort is an intrusion detection system, so the real question you should be asking is, "What type of unusual events does Snort detect on my network?" On any network using an IDS for the first time, you'll likely find a number of false positive reports. Your next question should then be, "Which of those alerts can I safely ignore?" Once you have the answers to those questions in hand, you can use Snort as part of your ongoing routine to monitor the network for potential security events.
Dig Deeper on Network Intrusion Detection (IDS)
Related Q&A from Mike Chapple
Encrypting data going to the cloud is a security best practice, but does it add extra challenges for regulators that might need to access the data? ...continue reading
Merchants that sell at off-site venues need to take extra care to follow PCI compliance standards. Expert Mike Chapple discusses how organizations ...continue reading
The FTC's order for PCI DSS compliance assessments is odd since PCI isn't a government regulation. Expert Mike Chapple explains the motivation ...continue reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.