Re: Any issues with dup packets on snort?

[Richard Bejtlich <taosecurity () gmail com>]

Jason Haar wrote:

> We have a range of switches being used within our network for port
> monitoring, and a couple have had to be set up in such a way that you
> can end up seeing each packet TWICE on the snort interface. I've been
> told by our network engineers that this has to be the case in order for
> the IDS to see the networks it needs to on one card.

Hi Jason,

I think I know why this is happening.  Essentially, the admin who sets
up the SPAN port has to decide if he or she wants to copy traffic in
to the SPAN port, out of the SPAN port, or in and out of the SPAN
port. If the decision is made to copy in and out of the SPAN port,
duplicate packets will appear when intra-switch traffic is carried.

I cover this issue in day one of my Network Security Operations
course.  I've posted the relevant slides here:

http://taosecurity.blogspot.com/2005/11/why-duplicate-packets-may-appear-on.html

If your system is configured as I think it is, you should only see
duplicates for intra-switch traffic.  Is that the case?

Sincerely,

Richard
http://www.taosecurity.com


-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems?  Stop!  Download the new AJAX search engine that makes
searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
http://ads.osdn.com/?ad_idv37&alloc_id865&op=click
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users