Re: Problems with detecting source ip

[Giles Coochey <giles () coochey net>]

On 28-11-2012 10:04, Dmitry Korzhevin wrote:
> Hi,
>
> I have server, which i user for VPN (ipsec and pptp). I configured
> Snort+barnyard2+mysql+snorby web interface.
You probably ought to disable PPTP...

> Problem, is when i login to snorby web interface, i see many alerts,
> but for all alerts Source IP - is server ip. I wish see internal
> client ip, not server ip.

Sounds like you are collecting on your outside interface after NAT has 
taken place.

Try attaching snort to the other (the inside one, facing your clients) 
Interface on the server.

------------------------------------------------------------------------------
Keep yourself connected to Go Parallel: 
INSIGHTS What's next for parallel hardware, programming and related areas?
Interviews and blogs by thought leaders keep you ahead of the curve.
http://goparallel.sourceforge.net
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!