Re: tcpdump installation on unix firewall?

[Lance Spitzner <lance () stan ksni net>]

On Fri, 27 Aug 1999, Robert Graham wrote:

> > Does it interfere with the FW-1 software?
>
> Probably not. However, it can slow down the system. A better solution would be
> to set up a separate system logging the packets "promiscuously", monitoring the
> same wire as the firewall, but not actually installed on the firewall.

First, I am a big fan of using sniffers on the actual firewall for troubleshooting
purposes.  I personally believe the benefits for troubleshooting far outweigh
the risks.  

With FW-1, sniffers capture the packets BEFORE the FW-1 filter inspects the packets,
regardless if it drops/rejects/accept etc.  This way you can compare what packets
are actually going through the box to what the FW sees in its logs.  This has
proven invaluable to me in numerous troubleshooting scenarios.

Lance Spitzner
http://www.enteract.com/~lspitz/papers.html