Mike Lieberman wrote:
Sorry about this use of bandwidth, but we are planning out our first
implementation of SNORT
If it's your 1st snort implementation, keep it simple, setup complex
sensors when you are 'fluent' in snort, acid, ...
and after reading some of the DOCs and reviewing the
FAQ we have a TAP hardware question.
In Brian Laing's excellent "How To Guide: Intrusion Detection Systems" he
states that "Without extra modifications the solution cannot monitor traffic
in both directions" [page 11] and "Terminate Sessions: Since Taps only allow
traffic to flow in one direction the IDS cannot terminate sessions" [page
17]
These taps make sure the sensor do not send information over the
network, you may consider it is a kind of security measure. Sending and
receiving packets do not need a tap, you need a network connection (and
a little configuration of your switch if you have one and want to be
able to monitor traffic not targuetting your sensor. this feature is
sometimes called port mirroring or port monitoring)
I have been looking at two Active Taps (such as the NCT1C) in which the
manufacturers indicate that both directions are sent to the IDS system.
Is this type of Tap compatible with SNORT?
Yes, the sensor will receive the whole traffic, which is fine. If you
want to send packets over the network (for an acid db or for killing tcp
sessions), you need a device with such capabilities (a switch, for
example),or you'll need a 3rd nic for sending packets (this later one
have to be plugged into your network, not a one direction tap).
If yes, is the information on "Terminate Sessions" on page 17 still accurate
with the need for two Taps and a Top Layer Switch or can it be done with
this type of single Active Tap?
Basically, terminating a session requires snort to send packets, the tab
you describe only alows your sensor to receive packet, make your own
conclusion on your needs..
Also, there is a Datacom Systems' SINGLEstream which has Two Taps, both of
which "combine the two data streams, allowing any connected 10/100
monitoring device to receive a full-duplex stream of data with one NIC."
Could this be used for bi-directional Kills?
I guess it's more expensive than adding a second NIC in your
sensor(there is an existing linux driver allowing you to combine the 2
incoming streams into a virtual NIC, which seems about the same as the
datacom solution) The solution looks nice (although additional
hardware=,in my mind, additional failures), but I would probably opt for
a more simple linux/bsd solution with a lot of NICs (there are some
quad ethernets, just in case). If your budget is limited, you could even
use the same box fox firewalling, IDS, proxy, mail gateway(with av),....
In order to keep it simple, begins to setup your new box as a stupid
router, add features when you're confident with your previous setup, try
not to be too fast. If you need 1 year to get the box configured as you
want, it's better than nothing.
-------------------------------------------------------
SF.Net email is sponsored by Shop4tech.com-Lowest price on Blank Media
100pk Sonic DVD-R 4x for only $29 -100pk Sonic DVD+R for only $33
Save 50% off Retail on Ink & Toner - Free Shipping and Free Gift.
http://www.shop4tech.com/z/Inkjet_Cartridges/9_108_r285
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
