Ethical Hacking

Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package.
Computer Forensics Training at InfoSec Institute

Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors.




Network Security Snort-Users
[Top] [All Lists]
<prev [Date] next>
[Advanced]
 <prev [Thread] next>

Re: [Snort-users] ssh-tunnel between sensor and database-server

from [Skip Carter] Network Security [Permanent Link]
Subject: Re: [Snort-users] ssh-tunnel between sensor and database-server
Date: Fri, 27 Aug 2004 08:28:14 -0700 


I have build an ssh-tunnel between my snort-sensor and my
database-server and it seems to work.

I had like to control this with tcpdump and it shows something like
this:

      "IP1".32817 > "IP2".22 
      "IP2".22 > "IP1".32817



I expect port 3306 instead of 32817 and that confuses me.

Can anyone explain me why 32817 is used?
Does ssh "hide" the source-port by using it?


    This just looks like the other end of your interactive session.

    I presume you are doing something like (from IP1):

    ssh -R 3306:IP2:3306 IP2

    If so, you should see on IP2 a service listening on IP2 at 3306 after you 
have
    authenticated.   'netstat -an' might be a more useful diagnostic to see if
    you got it working, tcpdump won't help until you start pushing data 
through it.



Skip





-- 
 Dr. Everett (Skip) Carter      Phone: 831-641-0645 FAX:  831-641-0647
 Taygeta Scientific Inc.        INTERNET: skip@taygeta.com
 1340 Munras Ave., Suite 314    WWW: http://www.taygeta.com
 Monterey, CA. 93940

Attachment: pgpLvvq44dTvz.pgp
Description: PGP signature

[More with this subject...]




<Prev in Thread] Current Thread [Next in Thread>
Previous by Date:  Re: [Snort-users] Will only detect server IP, Matt Kettler
Next by Date:  [Snort-users] Newbie Question -- Problem with snort-mysql install on debian, Jonathan Jesse
Previous by Thread:  [Snort-users] ssh-tunnel between sensor and database-server, Maetzky (extern)
Next by Thread:  Re: [Snort-users] ssh-tunnel between sensor and database-server, Sean Brown
Indexes:  [Date] [Thread] [Top] [All Lists]