I am not sure what the listening port is on MySQL.  I tried what I think is the default of 3306 and still I am getting the following error:

 

database mysql_error: Can't connect to MySQL server on '10.250.254.253' (111)
Barnyard2 exiting
database: Closing connection to database "snort"

 

My barnyard.conf file looks like this:

 

output database: log, mysql, user=snort password=l0gg3r dbname=snort host=10.250.254.253 port=3306 sensor_name=WinIDS-Madrid

 

My remote sensor ip address is 10.250.253.253

 

I have read where remote access to MYSQL is off by default,  could this be the reason for the error and if so,  how might I enable remote access??

 

 

I am not sure what the listening port is on MySQL.  I tried what I think is the default of 3306 and still I am getting the following error:

 

database mysql_error: Can't connect to MySQL server on '10.250.254.253' (111)

Barnyard2 exiting

database: Closing connection to database "snort"

 

My barnyard.conf file looks like this:

 

output database: log, mysql, user=snort password=l0gg3r dbname=snort host=10.250.254.253 port=3306 sensor_name=WinIDS-Madrid

 

My remote sensor ip address is 10.250.253.253

 

I have read where remote access to MYSQL is off by default,  could this be the reason for the error and if so,  how might I enable remote access??

 

 

 

Remote access is as simple as having the appropriate port opened on the master database to the outside world, and giving the remote client the appropriate permissions to connect to the master database. Keep in mind that this is NOT secure way to connect client to master, and Winsnort.com  has not tackled that in a tutorial, as it is an advanced option.

 

My guess is; if you have made sure that the default port of 3306 is open to the outside world on the master sensor, and it has been verified, then its most likely a user permission problem. You might want to setup a specific user account for remote access and adjust the barnyard2.conf for access.

Thank you for your input...  I think my problem was that on my Master DB,  I need to modify the my.ini file and comment out the line "bind-address=127.0.0.1.   In my case my slave sensor is just in another zone on my local network so the master is not open to the world.  Thanks again for your help

Let us know if it works and I can add that to the tutorial.