Home page logo
/

basics logo Security Basics mailing list archives

Re: Snort and ADSL
From: "Mike Gilligan" <mikewgilligan () hotmail com>
Date: Sat, 25 Mar 2006 10:42:08 +0800

thanks for the advice on using the Ethernet Tap.
Yes I did consider the tap but remember my Netscreen FW has an integrated ADSL port so these are not two separate devices that I can put a TAP between. The telephone cable plugs directly from the wall into my Netscreen ADSL Firewall and therein lies the problem. Unless there is some way to plug an RJ11 cable into an ethernet tap which I haven't seen done before.

Mike.

From: James Fryman <jfryman () gmail com>
To: Mike Gilligan <mikewgilligan () hotmail com>
CC: security-basics () securityfocus com
Subject: Re: Snort and ADSL
Date: Fri, 24 Mar 2006 15:36:26 -0500

Mike,

Two options.

1) Get yourself a passive ethernet tap. These can be made cheaply or
bought for some $$. Keep in mind, good taps are not cheap.

2) Grab a cheap dummy hub, and stick it inbetween your Netscreen and
your DSL modem. Stick your snort box in promiscuous mode, and snort
away! I would create yourself a listening Cat5 cable on Internet NIC
segment to prevent any outgoing traffic on your listening port back to
the Internet.

Some good documents exist on the Snort website to get you started:
http://www.snort.org/docs/#deploy

Good luck.

-James

Mike Gilligan wrote:
> Hi list.
> I have a Netscreen 5GT ADSL FW at my home with two interfaces - inside
> and outside. I do have a basic set of IDS sigs on the Netscreen but I
> would like to set up a Snort sensor outside the Firewall to look at
> unblocked alerts. However, I only have an RJ11 telephone cable to my
> ADSL port on the Netscreen and no where to plug in a Snort sensor. I
> could plug it in on the inside but I miss a lot of the traffic already
> dropped. I know that some SOHO Firewalls like the Linksys ones let you
> run Snort on the box itself but this isn't an option for me. Could
> anyone suggest a feasible solution?
>
> thanks.
>
> _________________________________________________________________
> Get an advanced look at the new version of MSN Messenger.
> http://messenger.msn.com.sg/Beta/Default.aspx
>
>
> ---------------------------------------------------------------------------
> EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE
> The Norwich University program offers unparalleled Infosec management
> education and the case study affords you unmatched consulting
> experience. Tailor your education to your own professional goals with
> degree customizations including Emergency Management, Business
> Continuity Planning, Computer Emergency Response Teams, and Digital
> Investigations.
> http://www.msia.norwich.edu/secfocus
> ---------------------------------------------------------------------------
>

--
-------------------------
James Fryman
email : jfryman () gmail com
Cell : 757.812.3126
GnuPG : 0xDAE2C750

 "Users are encouraged to engage in the application of a Nerf Bat,
  or a more sophisticated LART, if needed, to correct the behavioral
  vector of this attack. "
        - Bill Nash / Bugtraq Mailing List
         Preventing PHP Session Hijacking within a Home LAN Segment


_________________________________________________________________
Keep track of Singapore & Malaysia stock prices. http://www.msn.com.sg/money/


---------------------------------------------------------------------------
EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE
The Norwich University program offers unparalleled Infosec management education and the case study affords you unmatched consulting experience. Tailor your education to your own professional goals with degree customizations including Emergency Management, Business Continuity Planning, Computer Emergency Response Teams, and Digital Investigations.
http://www.msia.norwich.edu/secfocus
---------------------------------------------------------------------------


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]