Listen at location Q, analyze at location X

[Richard Bejtlich <richard_bejtlich () yahoo com>]

This message is intended as a response to Everett
Ward's question on how to listen at one location and
analyze traffic at another.  Although the original
question mentioned Windows and Linux, an all-Linux
architecture might be able to use the recently
announced SVtun
(http://www.cs.tau.ac.il/~nnavi/vtun/).  From the
Packetstorm description:

"SVtun is a simple and powerful distributed sniffer
which is based on virtual tunnels. It extends the
basic encryption and compression functionality of vtun
to support a new interface type "sniff" and provides
simple and efficient packet filtering and basic
asymmetric processing for client/server roles. SVtun
is useful for delivering traffic captures from probes
to the central server, so that traffic analysis,
disk-logging and/or intrusion detection can be
performed there."

I haven't tried it yet.

Good luck,

Richard Bejtlich
richard at taosecurity dot com
http://taosecurity.com


__________________________________
Do you Yahoo!?
SBC Yahoo! DSL - Now only $29.95 per month!
http://sbc.yahoo.com


-------------------------------------------------------
This SF.Net email is sponsored by: INetU
Attention Web Developers & Consultants: Become An INetU Hosting Partner.
Refer Dedicated Servers. We Manage Them. You Get 10% Monthly Commission!
INetU Dedicated Managed Hosting http://www.inetu.net/partner/index.php
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users