Re: Sniffing split connections

[Adam Powers <apowers () lancope com>]

If you can live with flow-based analysis (such as NetFlow or sFlow) you can
reassemble the asymmetrically routed flows from each "sides of town" into a
single box.

StealthWatch allows for this kind of "flow reassembly" (also called "flow
normalization").

The tradeoff, of course, is that you don't get actual payload with NetFlow
and only *some* payload with sFlow. Depending on what your requirements are
this may be enough, especially if statistical anomaly detection fulfills
your requirements.

BTW: You can run an open source app such as nprobe or fprobe on the 1750 to
generate the NetFlow records (so you don't really even need a Cisco router
at each site).

-AP


On 4/11/05 12:37 PM, "Chris Mills" <securinate () gmail com> wrote:

> Hi all-
>
> Here's the problem I'm having:
>
> I have a client site that has two physical connections from its ATM
> switch that connect to two different providers. The ATM switch uses
> both connections all the time (not set up as a failover.) The ATM
> switch at the site will not let me mirror the ports so I can't sniff
> there... and after the two providers, the connection is too fast for
> my equipment. I am using Snort 2.3.2 on PowerEdge 1750's. If I place a
> sniffer at both provider A and provider B, is there a way I can
> reassemble the traffic so I can see complete sessions? The two
> providers are on different sides of town.
>
>                |--------|PROVIDER A|\
> Client Site|                |-----------|INTERNET|
>                |--------|PROVIDER B|/
>
> Thanks very much,
>
> Chris
>
> --------------------------------------------------------------------------
> Stop hurting your network!
>  
> The NeVO passive vulnerability sensor continuously finds vulnerabilities,
> applications and new hosts without the need for network scanning.
> It also finds compromised systems with application-based intrusion detection.
> Go to http://www.tenablesecurity.com/products/nevo.shtml to learn more.
> --------------------------------------------------------------------------




--------------------------------------------------------------------------
Stop hurting your network!
 
The NeVO passive vulnerability sensor continuously finds vulnerabilities, 
applications and new hosts without the need for network scanning. 
It also finds compromised systems with application-based intrusion detection. 
Go to http://www.tenablesecurity.com/products/nevo.shtml to learn more.
--------------------------------------------------------------------------