Thanks for your help, and I fully realise that in the man page there is an entry about running Snort in Daemon mode. The point is that I didn't KNOW that 'Daemon' mode was the same as 'running in the background' - as far I as knew daemons were programs that monitored ports.
So, sorry about that. One more thing - I'd like Snort to startup automatically, could you tell me where the startup script is located? Also - the log files have root file permissions, and I gather it's a good idea to keep it that way. At the moment (if I log on as normal user) I have to su, then run Snort, then return to my normal account. Does this mean that Snort will still run in the background? Or does it terminate as soon as I su out of root? How can I check that it's running? It doesn't turn up in the processes list. Thanks once again, Thomas Madhavan A level student. -----Original Message----- From: Simon Barr [mailto:[EMAIL PROTECTED]] Sent: Thursday, November 29, 2001 9:33 AM To: [EMAIL PROTECTED] Subject: RE: Snort/Hogwash help > -----Original Message----- > From: Thomas Madhavan [mailto:[EMAIL PROTECTED]] > Sent: 27 November 2001 08:00 > To: [EMAIL PROTECTED] > Subject: Snort/Hogwash help > > > Hi guys, > > I'm a pretty new user to Linux, and I want to set up some sort of > protection > for my box. I have snort installed and I'm looking for rulesets - the > problem I have is this: > > When I run snort, it runs in a terminal. How exactly do I set > snort to just > run in the background, collecting unusual packets? I'm sure there > must be a > way. > > Also, is Hogwash a suitable tool to use instead of/as well as > snort? I need > something that is relatively simple but also effective. > > Regards, > > Thomas Madhavan > Thomas, RTFM ! I only say this because if you ask questions that can be answered by reading the docs some people get very upset by this and can get quite rude. Look in the man page for Snort. <HINT> look for Daemon. As for Hogwash I've never used it so I can't answer that one. HTH Simon Barr Systems Engineer Chelsing Assemblies Ltd E-mail: [EMAIL PROTECTED]
