Re: Asymmetric routing and IDS correlation ?

[Jason Haar <Jason.Haar () trimble co nz>]

On Tue, Mar 23, 2004 at 11:32:24AM -0600, Josh Berry wrote:
> I am not sure how to do this with Snort alone, but you can use a device
> that aggregates traffic such as the TopLayer IDS Balancer, feeding both
> SPAN's into the Balancer and spitting them back out of one interface into
> the Snort IDS sensor.

A simpler answer may be that you can just move the IDS to a better position.

e.g

Route 1 -----> |        |
               | Switch | ----> network
Route 2 -----> |        |

Instead of placing 2 IDSes on the left hand side of the switch, place one on
the right hand side... No routing issues to worry about then

Obviously the solution you need has to match your exact conditions, so maybe
that isn't appropriate/etc.

-- 
Cheers

Jason Haar
Information Security Manager, Trimble Navigation Ltd.
Phone: +64 3 9635 377 Fax: +64 3 9635 417
PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1


-------------------------------------------------------
This SF.Net email is sponsored by: IBM Linux Tutorials
Free Linux tutorial presented by Daniel Robbins, President and CEO of
GenToo technologies. Learn everything from fundamentals to system
administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users