Sorry about this use of bandwidth, but we are planning out our first
implementation of SNORT and after reading some of the DOCs and reviewing the
FAQ we have a TAP hardware question.
In Brian Laing's excellent "How To Guide: Intrusion Detection Systems" he
states that "Without extra modifications the solution cannot monitor traffic
in both directions" [page 11] and "Terminate Sessions: Since Taps only allow
traffic to flow in one direction the IDS cannot terminate sessions" [page
17]
I have been looking at two Active Taps (such as the NCT1C) in which the
manufacturers indicate that both directions are sent to the IDS system.
Is this type of Tap compatible with SNORT?
If yes, is the information on "Terminate Sessions" on page 17 still accurate
with the need for two Taps and a Top Layer Switch or can it be done with
this type of single Active Tap?
Also, there is a Datacom Systems' SINGLEstream which has Two Taps, both of
which "combine the two data streams, allowing any connected 10/100
monitoring device to receive a full-duplex stream of data with one NIC."
Could this be used for bi-directional Kills?
-------------------------------------------------------
SF.Net email is sponsored by Shop4tech.com-Lowest price on Blank Media
100pk Sonic DVD-R 4x for only $29 -100pk Sonic DVD+R for only $33
Save 50% off Retail on Ink & Toner - Free Shipping and Free Gift.
http://www.shop4tech.com/z/Inkjet_Cartridges/9_108_r285
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
