Ok..
Network taps and port mirroring..
I think I understand how the port mirroring works, but, for network tap, how
can I do this technically?
um..the cable that used for tapping, is it connecting the sensor interface with
port on the switch? or what?
In this case, I has already configured the sensor to communicate with active
response agent locate in the firewall.
So I need to assign an IP address to the interface connected to gateway (also
operate as firewall).
I use TSL (Trustix Secure Linux) as a sensor, firewall, and servers. How can I
make the sensor interface unassigns
(without IP assigned), AFAIK, the other choices if we didn't statically assign
the IP address is DHCP. How about this?
----- Original Message ----
From: JJC <cummingsj@gmail.com>
To: snort <Snort-users@lists.sourceforge.net>
Sent: Wednesday, December 19, 2007 10:09:12 PM
Subject: Re: [Snort-users] [ASK] Silent Interface??
A second option would be to use port mirroring (or in the Cisco world
"SPAN"), this assumes that your switches support this feature. In
either the tap or port mirror scenario, the listening interface(s) do
not need DHCP or an IP address configured. It is, in fact, generally
recommended that you not have an address assigned to the interface that
will be sniffing the traffic. That said, you typically will have two
or more interfaces on your snort box, one for doing the sniffing (this
one without an ip and connected to the mirrored port) and the other for
management of the system itself and connected to your internal network
.
Cheers,
JJC
http://global-security.blogspot.com
On Dec 19, 2007 8:20 AM, Gould, Scott <
scott.gould@gogstats.org> wrote:
Mat,
You can place network taps between the gateway and
switch in your diagram. These taps have a monitor port that will connect
to the sensor, and in turn send a copy of all the traffic seen by the tap to
the
sensor.
Scott
Gould
Senior Network &
Systems Analyst
Gynecologic Oncology Group
Statistical & Data
Center
scott dot gould at gogstats dot
org
From: snort-users-bounces@lists.sourceforge.net
[mailto:snort-users-bounces@lists.sourceforge.net] On Behalf Of Rachmat
Hidayat Al-Anshar
Sent: Tuesday, December 18, 2007 11:10
PM
To: snort
Subject: [Snort-users] [ASK] Silent
Interface??
Hi guys...
Straightforward, I just wanna know deeper about "silent
interface" that we might use on sensors.
I have a topology like
this:
y
INTERNET ---- gateway -----
sensor
|
| x
|
|
+-------- switch --------- gateway -------
INTRANET
|
|
-------------
| |
|
(servers on DMZ)
is it true that we
can use the sensor interface silently monitoring the traffic flowing accross
the
switch ?
(marked with x)??
if the answers is correct, then how can i
do that??
is it with use the dhcp on in? or what??
Thanks in
advance
Any response will greatly appreciated
Mat
(^^)
Be a better friend, newshound, and know-it-all with Yahoo! Mobile. Try
it now.
-------------------------------------------------------------------------
SF.Net email is sponsored by:
Check out the new SourceForge.net Marketplace.
It's the best place to buy or sell services
for just about anything Open Source.
http://ad.doubleclick.net/clk;164216239;13503038;w?http://sf.net/marketplace
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
____________________________________________________________________________________
Never miss a thing. Make Yahoo your home page.
http://www.yahoo.com/r/hs-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2005.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
