Re: [ASK] Silent Interface??

[Rachmat Hidayat Al-Anshar <rachmat_hidayat_02 () yahoo com>]

Ok..
Network taps and port mirroring..

I think I understand how the port mirroring works, but, for network tap, how can I do this technically?
um..the cable that used for tapping, is it connecting the sensor interface with port on the switch? or what?

In this case, I has already configured the sensor to communicate with active response agent locate in the firewall.
So I need to assign an IP address to the interface connected to gateway (also operate as firewall).

I use TSL (Trustix Secure Linux) as a sensor, firewall, and servers. How can I make the sensor interface unassigns 
(without IP assigned), AFAIK, the other choices if we didn't statically assign the IP address is DHCP. How about this?


----- Original Message ----
From: JJC <cummingsj () gmail com>
To: snort <Snort-users () lists sourceforge net>
Sent: Wednesday, December 19, 2007 10:09:12 PM
Subject: Re: [Snort-users] [ASK] Silent Interface??


A second option would be to use port mirroring (or in  the Cisco world
"SPAN"), this assumes that your switches support this feature.  In
either the tap or port mirror scenario, the listening interface(s) do
not need DHCP or an IP address configured. It is, in fact, generally
recommended that you not have an address assigned to the interface that
will be sniffing the traffic.  That said, you typically will have two
or more interfaces on your snort box, one for doing the sniffing (this
one without an ip and connected to the mirrored port) and the other for
management of the system itself and connected to your internal network
.


Cheers,
JJC
http://global-security.blogspot.com

On Dec 19, 2007 8:20 AM, Gould, Scott <
scott.gould () gogstats org> wrote:







Mat,

 

You can place network taps between the gateway and 
switch in your diagram.  These taps have a monitor port that will connect 
to the sensor, and in turn send a copy of all the traffic seen by the tap to the 
sensor.

 



Scott 
Gould

Senior Network & 
Systems Analyst
Gynecologic Oncology Group
Statistical & Data 
Center
scott dot gould at gogstats dot 
org









From: snort-users-bounces () lists sourceforge net 
[mailto:snort-users-bounces () lists sourceforge net] On Behalf Of Rachmat 
Hidayat Al-Anshar
Sent: Tuesday, December 18, 2007 11:10 
PM
To: snort
Subject: [Snort-users] [ASK] Silent 
Interface??







Hi guys...

Straightforward, I just wanna know deeper about "silent 
interface" that we might use on sensors. 
I have a topology like 
this:

             
                  
         y
INTERNET ---- gateway ----- 
sensor
                
         
|                
| x
                
         |      
          |
    
                  
   +-------- switch --------- gateway ------- 
INTRANET
             
                  
            |
    
                  
                  
   |
             
                  
   -------------
          
                  
      |       |     
  |
             
            
       (servers on DMZ)

is it true that we 
can use the sensor interface silently monitoring the traffic flowing accross the 
switch ?
(marked with x)??

if the answers is correct, then how can i 
do that??

is it with use the dhcp on in? or what??

Thanks in 
advance 
Any response will greatly appreciated
Mat 
(^^)





Be a better friend, newshound, and know-it-all with Yahoo! Mobile. Try 
it now.




-------------------------------------------------------------------------
SF.Net email is sponsored by:
Check out the new SourceForge.net Marketplace.
It's the best place to buy or sell services
for just about anything Open Source.

http://ad.doubleclick.net/clk;164216239;13503038;w?http://sf.net/marketplace
_______________________________________________

Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:

https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users










      ____________________________________________________________________________________
Never miss a thing.  Make Yahoo your home page. 
http://www.yahoo.com/r/hs

-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2005.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users