[Dshield] Submitting logs from two devices

Anthony Rodgers Anthony_Rodgers at dnv.org
Thu Feb 8 23:44:29 GMT 2007


Hi there,

Is it acceptable to submit logs from two sources (Internet facing 
firewall and a snort IDS that resides inside the firewall)? My thinking 
is that our IDS picks up on badness that gets through our firewall's 
open ports and therefore might provide some additional useful data.

If so, is it sufficient to have two instances of the Universal Client 
running on a machine, using the same DShield ID?

Regards,
-- 
Anthony Rodgers
Business Systems Analyst
District of North Vancouver
Web: http://www.dnv.org
RSS Feed: http://www.dnv.org/rss.asp



More information about the list mailing list