Forwarding your email back to the snort-users list.
Begin forwarded message:
From: Rachmat Hidayat Al-Anshar <rachmat_hidayat_02@yahoo.com>
Date: December 21, 2007 10:02:30 PM EST
To: Joel Esler <joel.esler@sourcefire.com>
Subject: Re: [Snort-users] [ASK] Silent Interface??
X-Mailer: YahooMailRC/818.31 YahooMailWebService/0.7.158.1
Hi Joel
Um, I do need your suggestion here,
According to my topology below, what should I use so the sensor can
"silently" monitoring
the traffic. In my condition now, not allowing me to use switch with
SPAN or network tap device.
For a research I substitute the switch with hub (^^!). With this
condition, I think that
the sensor interface (marked with X) have to silently implemented
(with no IP address), but
my problem is, I have no idea how to make the interface with no IP
(because if not statically assigned
with IP address, the system offering me DHCP options there is no
option to void the ip).
how is it?
Original Message ----
From: Joel Esler <joel.esler@sourcefire.com>
To: Rachmat Hidayat Al-Anshar <rachmat_hidayat_02@yahoo.com>
Cc: snort <Snort-users@lists.sourceforge.net>
Sent: Saturday, December 22, 2007 9:36:35 AM
Subject: Re: [Snort-users] [ASK] Silent Interface??
A tap is usually external to the box. http://en.wikipedia.org/wiki/Network_tap
Traffic flows through the tap and the tap copies the traffic and
sends it to the sensor.
--
Joel Esler
joel.esler@sourcefire.com
On Dec 21, 2007, at 9:20 PM, Rachmat Hidayat Al-Anshar wrote:
Ok..
Network taps and port mirroring..
I think I understand how the port mirroring works, but, for network
tap, how can I do this technically?
um..the cable that used for tapping, is it connecting the sensor
interface with port on the switch? or what?
In this case, I has already configured the sensor to communicate
with active response agent locate in the firewall.
So I need to assign an IP address to the interface connected to
gateway (also operate as firewall).
I use TSL (Trustix Secure Linux) as a sensor, firewall, and
servers. How can I make the sensor interface unassigns
(without IP assigned), AFAIK, the other choices if we didn't
statically assign the IP address is DHCP. How about this?
----- Original Message ----
From: JJC <cummingsj@gmail.com>
To: snort <Snort-users@lists.sourceforge.net>
Sent: Wednesday, December 19, 2007 10:09:12 PM
Subject: Re: [Snort-users] [ASK] Silent Interface??
A second option would be to use port mirroring (or in the Cisco
world "SPAN"), this assumes that your switches support this
feature. In either the tap or port mirror scenario, the listening
interface(s) do not need DHCP or an IP address configured. It is,
in fact, generally recommended that you not have an address
assigned to the interface that will be sniffing the traffic. That
said, you typically will have two or more interfaces on your snort
box, one for doing the sniffing (this one without an ip and
connected to the mirrored port) and the other for management of the
system itself and connected to your internal network .
Cheers,
JJC
http://global-security.blogspot.com
On Dec 19, 2007 8:20 AM, Gould, Scott < scott.gould@gogstats.org>
wrote:
Mat,
You can place network taps between the gateway and switch in your
diagram. These taps have a monitor port that will connect to the
sensor, and in turn send a copy of all the traffic seen by the tap
to the sensor.
Scott Gould
Senior Network & Systems Analyst
Gynecologic Oncology Group
Statistical & Data Center
scott dot gould at gogstats dot org
From: snort-users-bounces@lists.sourceforge.net [mailto:snort-users-bounces@lists.sourceforge.net
] On Behalf Of Rachmat Hidayat Al-Anshar
Sent: Tuesday, December 18, 2007 11:10 PM
To: snort
Subject: [Snort-users] [ASK] Silent Interface??
Hi guys...
Straightforward, I just wanna know deeper about "silent interface"
that we might use on sensors.
I have a topology like this:
y
INTERNET ---- gateway ----- sensor
| | x
| |
+-------- switch --------- gateway -------
INTRANET
|
|
-------------
| | |
(servers on DMZ)
is it true that we can use the sensor interface silently monitoring
the traffic flowing accross the switch ?
(marked with x)??
if the answers is correct, then how can i do that??
is it with use the dhcp on in? or what??
Thanks in advance
Any response will greatly appreciated
Mat (^^)
Be a better friend, newshound, and know-it-all with Yahoo! Mobile.
Try it now.
-------------------------------------------------------------------------
SF.Net email is sponsored by:
Check out the new SourceForge.net Marketplace.
It's the best place to buy or sell services
for just about anything Open Source.
http://ad.doubleclick.net/clk;164216239;13503038;w?http://sf.net/marketplace
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
Looking for last minute shopping deals? Find them fast with Yahoo!
Search
.-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2005.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
Looking for last minute shopping deals? Find them fast with Yahoo!
Search.
-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2005.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
