It's a Link Aggregation tap.
Unfortunately I am the network guys ;-) I tore down the SPAN session and
rebuilt it with the same results. Util on the switch is ~10%
I'll give the tcpdump tests a try and see what that brings me and go from
there.
Thanks for the help Bamm!
-----Original Message-----
From: Bamm Visscher [mailto:bamm.visscher@gmail.com]
Sent: Friday, December 08, 2006 10:22 AM
To: John Hally
Cc: snort-users@lists.sourceforge.net
Subject: Re: [Snort-users] one way traffic?
Is this a SingleStream SPAN aggregation tap or a SingleStream Link
aggregation tap? If it's a SPAN aggregation tap, I'd check to make
sure the SPAN is setup correctly or hasn't "failed". If a switch gets
overloaded, it'll stop passing packets to the SPAN before it will
impact an active port. In my experience, most switches will leave the
SPAN down or crippled until the admin manually brings it back up.
I'd also try this:
Verify that you are only seeing tfc to the host
tcpdump -c 50 -i eth1 vlan and host xxx.xxx.xxx.xxx
Maybe there isn't any vlan tagging going on for some of the tfc
tcpdump -c 50 -i eth1 host xxx.xxx.xxx.xxx
After that, I think it'd be time to talk to the network guys and see
if they made any changes that would affect data flow past the tap.
Bammkkkk
On 12/8/06, John Hally <JHally@epnet.com> wrote:
Hello All,
I've noticed something strange with snort (2.4.3) and the sguil
log_packets.sh script. It seems like all of a sudden I'm seeing one-way
traffic. The sensor is running on Fedora Core5 and I want to say that it
may be attributed to a yum update, but I can't be certain exactly when
this
started happening.
Essentially I'm running snort in packet logger mode on a trunk port coming
off an edge router with BPF filters watching a specific host:
snort -l /var/log/snort/sensor/dailylogs/2006-12-08 -b -i eth1 vlan and
host
xxx.xxx.xxx.xxx
It seems that the traffic I capture is only destined to the host, not to
and
from. Is it possible something changed as far as the filters? The
traffic
is being captured off of a Gigabit SingleStream tap to a gigabit copper
interface in promisc mode. I've also tried a SPAN port to the same
interface with the same results.
Thoughts?
Thanks.
-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share
your
opinions on IT & business topics through brief surveys - and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
--
sguil - The Analyst Console for NSM
http://sguil.sf.net
-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys - and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
