Snort is an excellent Network Intrusion Detection System (NIDS) for various unices. The Snort homepage can be found at http://www.snort.org/. The version described here is 1.8.3 which was the actual version at the time of writing.
The statistic tools I will describe here are ACID, a database analysis tool for Snort which can be found at http://www.cert.org/kb/acid/ and SnortSnarf, a statistic tool for Snort logs downloadable from http://www.silicondefense.com/software/snortsnarf/index.htm.
Additional support packages are needed for ACID. These are a PHP4 capable webserver like apache (http://www.apache.org/), PHPlot used for creating graphs in PHP (http://www.phplot.com/) and ADODB used for connecting to databases with PHP (http://php.weblogs.com/ADODB/).
The description also includes which additional software is needed for ACID and how to configure along with some scripts I use including a changed version of the snortd initscript and a short chapter about swatch (http://www.stanford.edu/~atkins/swatch) a log file watcher script written in perl. I created a swatch RPM which can be found at http://www.lug-burghausen.org/projects/Snort-Statistics/swatch-3.0.2-1.noarch.rpm.
One hint for those interested in maintaining more than one snort sensor: You might take a look at IDSPM (IDS Policy Manager) at http://www.activeworx.com/ which is an application to maintain various sensors with different policies along with merging capabilities for new rules and a lot more. The only "nasty" thing is that it runs on W2K/XP and is not (yet?) Open Source.
If you have any questions, please contact <linux-howto at metalab.unc.edu>
The main site for this HOWTO is http://www.lug-burghausen.org/projects/Snort-Statistics/.
Mirrors may be found at the Linux Documentation Project or Snort homepages.
The newest version of this HOWTO will always be made available on the main website, in a variety of formats:
Credits go to a variaty of people including
Martin Roesch <roesch at sourcefire.com> Author of Snort
Roman Danyliw <roman at danyliw.com> Author of ACID
James Hoagland <hoagland at SiliconDefense.com> Author of SnortSnarf
Stuart Staniford <stuart at SiliconDefense.com> Author of SnortSnarf
Joe McAlerney <joey at siliconDefense.com> Author of SnortSnarf
John Lim <jlim at natsoft.com.my> Author of ADODB
Afan Ottenheimer <afan at users.sourceforge.net> Author of PHPlot
Andreas Östling <andreaso at it.su.se> Author of arachnids_upd
Max Vision <vision at whitehats.com> "Distributor" of vision.rules and maintainer of http://www.whitehats.com/
Greg Sarsons <gsarsons at home.com> for proof reading and suggestions
All the peaople on the snort-users mailinglist, they helped me and of course they will help YOU >;)
...
If I missed someone it was not because of not honoring her or his work!