barryab63-ia@yahoo.com wrote: Date: Wed, 30 Nov 2005 00:09:31 -0800 (PST)
From: <barryab63-ia@yahoo.com>
Subject: Re: [Snort-users] Any issues with dup packets on snort?
To: Jason Haar <Jason.Haar@trimble.co.nz>
I think we'd need a little more information on this one. Can you give us an
example of how the switch monitoring ports of feeding the snort interface.
Depending on the setup this could be normal. I'd try to avoid it because
it's just more data you have to wade through. But, depending on your setup it
might be unavoidable.
Barry
Jason Haar <Jason.Haar@trimble.co.nz> wrote:
Hi there
We have a range of switches being used within our network for port
monitoring, and a couple have had to be set up in such a way that you
can end up seeing each packet TWICE on the snort interface. I've been
told by our network engineers that this has to be the case in order for
the IDS to see the networks it needs to on one card.
i.e.
src-ip->dst-ip SYN
dst-ip->src-ip SYN-ACK
actually looks like
src-ip->dst-ip SYN
src-ip->dst-ip SYN
dst-ip->src-ip SYN-ACK
dst-ip->src-ip SYN-ACK
Anyway, I have no problem with that, and snort "seems" to be happy too.
Can someone confirm that duplicate packets aren't a problem? That
worst-case should be duplicate alerts?
Thanks
--
Cheers
Jason Haar
Information Security Manager, Trimble Navigation Ltd.
Phone: +64 3 9635 377 Fax: +64 3 9635 417
PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1
-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems? Stop! Download the new AJAX search engine that makes
searching your log files as easy as surfing the web. DOWNLOAD SPLUNK!
http://ads.osdn.com/?ad_id=7637&alloc_id=16865&op=click
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
