Hi Jason,
It sounds like, rather than running multiple instances of snort in
different places on your network, you're copying data from multiple
locations on the network back to a single snort interface.
There's no real problem with a configuration like this. You'll probably
get duplicate detects, but you'd get that anyway if you were running
multiple snort instances reporting back to a single location.
- Ramon
Jason Haar wrote:
We have a range of switches being used within our network for port
monitoring, and a couple have had to be set up in such a way that you
can end up seeing each packet TWICE on the snort interface. I've been
told by our network engineers that this has to be the case in order for
the IDS to see the networks it needs to on one card.
i.e.
src-ip->dst-ip SYN
dst-ip->src-ip SYN-ACK
actually looks like
src-ip->dst-ip SYN
src-ip->dst-ip SYN
dst-ip->src-ip SYN-ACK
dst-ip->src-ip SYN-ACK
Anyway, I have no problem with that, and snort "seems" to be happy too.
Can someone confirm that duplicate packets aren't a problem? That
worst-case should be duplicate alerts?
-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems? Stop! Download the new AJAX search engine that makes
searching your log files as easy as surfing the web. DOWNLOAD SPLUNK!
http://ads.osdn.com/?ad_id=7637&alloc_id=16865&op=click
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
