FAQ

Q. What is BASE?
A.  BASE is a fork of ACID. It’s not “ACID”. BASE uses existing Snort Databases and provides a GUI-way to analyze Snort events stored in mysql, postgres, and mssql databases.  Starting with version 2.0 of BASE it will be a standalone tool with a native GUI, while the web-based engine will still be supported, it will be in addition to a much powerful tool.

Q.  What does it require?
A.  The preferred Operating System it is to be run on is Linux, however, it will run on any platform including Mac OS X (even Windows ;) that can support Apache, PHP, and any of the databases that are supported.

Q.  You say I can use Windows?
A.  Yes, but we encourage you to broaden your horizons.  Experience has proved that the Windows kernel will drop packets when using Snort under load.  Linux will also drop packets, but not until the Load is extremely heavy.  If you are interested in running an IDS on Windows, check out http://www.winsnort.com.  WinSnort.com uses BASE in their install guides.

Q.  You say I can use Oracle, Maxsql, postgres, mysql, or mssql?  
A.  Yes, but it's preferred you use MySql.  It's more widely supported than postgres, and doesn't require a license like mssql or Oracle.

Q.  Snort writes to Oracle, will BASE read the oracle database?
A.  Beginning with version 1.1.2 Oracle support was built in.

Q.  Snort will write directly to the database, should I do this?
A.  You can, but...  under heavy load where Snort will generate several alerts, it has been proven that Snort will drop packets if writing to a database directly.  It's preferred that the Snort output module “unified” be used in order to minimize packet loss.

Q.  Does BASE read unified logs?
A.  Nope, you have to use Barnyard to put the unified logs into a MySQL Database.  This removes the Database input from the IDS and places it into a separate program/process, thus making the IDS..... perform IDS functions.  If our developers have time, we'll answer questions about barnyard, but we suggest you check out the barnyard users list.  

Q.  I've installed Snort what else do I need?
A.  You need Apache (the webserver, www.apache.org), Php (www.php.org), and a database.  The BASE project officially supports www.internetsecurityguru.com 's install guide written by Patrick Harper for the Linux platform, and www.winsnort.com 's install guide for Windows.

Q.  Have you ever heard of OpenAanval?
A.  Yes, It's a good product, (in fact we have helped troubleshoot some of their problems...  )  we find it especially useful to use in conjunction with BASE.  We are thinking about building in some functionally that we like from OpenAanval into BASE.

Q.  How big of a Database can BASE handle.  
A.  How big do you want the database to be?  The faster the machine you run BASE on, the faster the Database queries will run.  We've used BASE on everything from home machines to HUGE Databases that store millions of events from hundreds of sensors to standalone sensors at our houses.  We're working to make BASE faster with less queries per page, and more optimization in the background.

Q.  What versions of Windows are supported?
A.  Windows 2000 Professional, Windows 2000 Server, and Windows XP Professional.  We have not had experience running the product on Windows XP Home.

Q.  What distros (versions) of Linux are supported?
A.  Fedora Core 2 or 3 is the preferred distro, however, we have had reports and experience of running our product on nearly every distribution of Linux.

Q.  Is there a debian package?
A.  At the time of this writing, no, but it is currently being worked on.

Q.  Is there an RPM?
A.  At the time of this writing, no, but it is currently being worked on and submitted through the Fedora chain.

Q.  Will it run on Mac OS X?
A.  Providing the dependencies are there (Apache – which comes with OS X), PHP (also comes on it), mysql, and snort.  Yes it will run.

Q.  Are there install guides to BASE?
A.  Yes!
http://drider.sourceforge.net/docs/snort/snort_install_guide_FC3_2.txt 
http://www.internetsecurityguru.com
http://www.winsnort.com

Q.  I can't find the Database Schemas anymore!  They used to be in the contrib directory right?
A.  Right, beginning with Snort 2.3.0RC1, Snort developers have moved the database schemas from the 'contrib' to 'schemas' directory.

Q.  I have this problem in ACID, it says “Database ERROR:Database ERROR:Duplicate entry '1-7622' for key 1”  in red.  If I hit refresh it goes away.  Will I have this problem with BASE?
A.  BASE fixes this.  This has to do with duplicate entries in the DB.

Q.  On the administration page I see “Cache & Status”, do I need to go in here and Rebuild the Alert, DNS, and Whois Caches?
A.  No, BASE will do this on-the-fly.  However, if you want BASE to run faster doing dns and whois lookups, you can update these.  The BASE development group is working on writing another standalone process to automate this task.  There is also a perl script to do this automatically in the “Scripts” directory.  Set it up as a cronjob!