I run snort as my IDS. I honestly do not see what good it dose. I cancled out all the stuff I do not need from it, or attempted to, yet my alert file is still huge. All different kinds of errors. I do not undertand what good it does if I cant get any real information. What IDS do you use and how do you make it most efficient?
