Ethical Hacking

Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package.
Computer Forensics Training at InfoSec Institute

Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors.




Network Security Snort-Users
[Top] [All Lists]
<prev [Date] next>
[Advanced]
 <prev [Thread] next>

Re: [Snort-users] Will only detect server IP

from [Matt Kettler] Network Security [Permanent Link]
Subject: Re: [Snort-users] Will only detect server IP
Date: Fri, 27 Aug 2004 11:20:55 -0400
At 05:18 PM 8/26/2004, Don Hammer wrote: 
I am running snort on RedHat 9.0. It is collecting and reporting alerts, but
only alerts to of from the IP address of the server snort in running on. I
have another system that is on the same hub and snort will not detect any
alerts from that system. Any ideas?


Are your sure your hub is really a true hub?

If it's 10/100 dual speed, it may be more like a switch than a hub. Some of these act like half-duplex switches, some act like a 10mbit hub and a 100mbit hub connected by a 2-port switch (aka bridge). All must have some form of switch-like behavior, as it's impossible to act like a pure passive hub and suppor both speeds. (Any 10/100 dual speed hub trying to be purely passive with no switching would be bandwidth limited to 10mbit.)

Try firing up tcpdump or etherreal to see if the traffic of interest ever gets to your snort box.




-------------------------------------------------------
This SF.Net email is sponsored by BEA Weblogic Workshop
FREE Java Enterprise J2EE developer tools!
Get your free copy of BEA WebLogic Workshop 8.1 today.
http://ads.osdn.com/?ad_id=5047&alloc_id=10808&op=click
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users

[More with this subject...]




<Prev in Thread] Current Thread [Next in Thread>
Previous by Date:  [Snort-users] Need to merge sid-msg.map and bleeding-sid-msg.map ?, Brandon Applegate
Next by Date:  Re: [Snort-users] ssh-tunnel between sensor and database-server, Skip Carter
Previous by Thread:  [Snort-users] Will only detect server IP, Don Hammer
Next by Thread:  RE: [Snort-users] Will only detect server IP, Don Hammer
Indexes:  [Date] [Thread] [Top] [All Lists]