[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[ossec-list] Re: windows file integrity question, ossec is great!



the problem with tcp is that it creates considerable more network load. Also udp services like snmp and syslog are used so the client doesn't hang.
I think we should stick to UDP.


On 9/4/06, marc bayerkohler <marc.bayerkohler@xxxxxxxxx> wrote:
Someone else suggested moving to TCP, which would take care of this automatically.

In the environments I work in, logging is vital and must be reliable to be considered. I have never heard any one complain about ids/firewall/logging that tcp connections weren't fast enough.

marc



On 8/25/06, Martin Leung < ccmartin@xxxxxx> wrote:
Hi,

>>> gentux
>> UDP being connectionless, I don't see how the client can possibly "know"
>> that the message was received; however, a modifiable threshold on the
>> server could possibly help with the issue.  For example, a setting in
>> the .conf file that tells it to expect 5 messages every 15 minutes,
>> otherwise send an alert (numbers complete subject to user
>> determination).  Of course, a better place for the setting would be in
>> the clients.conf file so that you can set these specs per client rather
>> than an overall setting for the server.
>

Sorry for interrupt but I've an idea on acknowledgement to share:

- Add an unique sequence ID to each message the client send.
- Define a threshold that the server has to acknowledge,
   e.g. every 100 messages
- client caches all unacknowledge message
- when the threshold is reached, client will resent all
   unacknowledge message
- Server acknowledges client with the last sequence number received
   occassionally

Rgds.
Martin






--
marc


OSSEC home | Main Index | Thread Index


OSSEC project: www.ossec.net.
Mailling list information: http://www.ossec.net/en/mailing_lists.html.