We've left the DHCP server detection rules in place and have picked up several other rogue servers. We use snortsnarf, a perl application mentioned in Part 2 of our IDS series , to parse the snort alert files and generate HTML pages that we check once or twice a day. Using snortsnarf is much easier than trying to go through snort's voluminous alert files by hand. Using defined address tables isn't an option when you're serving up 6,000 addresses. Robert Currier has been in data networking for more than 15 years, the last five as director of data communications at Duke University.
Currier is an accomplished writer, public speaker, and photographer.
His credits include product reviews in Network World, features in PC Computing, and photographs in the Chronicle of Higher Education.