Re: Sniffing split connections

[Richard Bejtlich <taosecurity () gmail com>]

On 4/11/05, Chris Mills <securinate () gmail com> wrote:
> Hi all-
>
> Here's the problem I'm having:
>
> I have a client site that has two physical connections from its ATM
> switch that connect to two different providers. 

Hi Chris,

Could you tap these two ATM links with two of these Net Optics products?

http://www.netoptics.com/products/product_family_details.asp?cid=1&pid=47&Section=products&menuitem=1

Then send the two sets of outputs to a single sensor, and bond those
four interfaces to a single virtual interface that you then monitor?

Richard

--------------------------------------------------------------------------
Stop hurting your network!

The NeVO passive vulnerability sensor continuously finds vulnerabilities,
applications and new hosts without the need for network scanning.
It also finds compromised systems with application-based intrusion detection.
Go to http://www.tenablesecurity.com/products/nevo.shtml to learn more.
--------------------------------------------------------------------------