[snajd]

Hi all.
I just read that you can have snort listening to pf:s log interface and get a lot of nice functions, i.e. log to a mysql/postgres database.

The thing is that if i make snort listen on pflog0, i get no alerts at all. Read in a newsgroup that the reason probobly is that pflogd defaults to snaplength 96, and that you should rise it to 1500. I have done it and still doesnt get any alerts.
I have read everywhere that i can think of (snorts manfiles, the docs on snort.org, google, etc), but can't seem to find anything anywhere.

anyone that have successfully made snort listen as a IDS on pflog0, please reply!

:oops: :oops: :shock:

[bsdjunkie]

Read in a newsgroup that the reason probobly is that pflogd defaults to snaplength 96, and that you should rise it to 1500.

I think that was in response to a question I asked ;) I was having trouble seeing any traffic using it as a log interface. After increasing the snaplen it worked fine though. I ended up just snorting the external interface, since all traffic will be seen by bpf before pf does any processing on it anyways.