snort, postgres, bridge

[Louis Kowolowski]

I've been prowling through the FreeBSD and Snort list archives in 
search of information on setting up snort on a FreeBSD bridge(4)
that logs to a remote postgres box via a third interface (hme0)
Snort is being started with the following command:

/usr/local/bin/snort -A full -D -e -d -s -i fxp0 -c /usr
/local/etc/snort.conf 

Where fxp0 and fxp1 are in the bridge
output from sysctl:

net.link.ether.bridge_cfg: fxp0:0,fxp1:0
net.link.ether.bridge: 1
net.link.ether.bridge_ipfw: 0
net.link.ether.bridge_ipf: 1
net.link.ether.bridge_ipfw_drop: 0
net.link.ether.bridge_ipfw_collisions: 0

The snort.conf is attached.  I've attempted to start with a pretty
generic config, just to ensure things work.

The problem appears to be that snort simply doesn't log to the remote
postgres box (yes, there are host entries in pg_hba.conf, and other
databases are accessible remotely, so I believe that is not the issue).
I've just been running trafshow to watch connections.

Any hints/pointers/solutions welcome.

Thanks
-- 

Louis Kowolowski                                louisk at cryptomonkeys.org
Crypto Monkeys:                     http://www.cryptomonkeys.org/~louisk
IRC:                                    outcast-consultants.biz#outcasts
gpg info:		 			 http://www.cryptomonkeys.org/~louisk/gurgi.html
gpg print:            F04B 9A37 822A 4CE1 95CE  4D28 1AFF CCB7 DE4B A841

Everyone is a genius.  It's just that
some people are too stupid to realize it.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 187 bytes
Desc: not available
Url : http://lists.freebsd.org/pipermail/freebsd-security/attachments/20030828/5cdd21c2/attachment.bin