Snort mailing list archives
IDS placement
From: Always Bishan <bishan4u () yahoo co uk>
Date: Mon, 7 Jul 2003 07:48:49 +0100 (BST)
Hi Snorters, We have to deploy Snort at our clients network, their network diagram is as follows: -------------- |ISP(64 Kbps)| -------------- | |NIC 1 DMZ ------------------- NIC4 ------- -------------- |IPtables Firewall|-------| Hub |-----| FTP server | ------------------- ------- -------------- |NIC2 |NIC3 Redhat Linux | | | | | | ------------- ------------------ | Switch | | Hub and Switch |----- ------------- ------------------ | | | | | | Subnet2 ------------ | Subnet 1 | ------------ (with 1 Linux m/c) Now the queries are: 1. What would be the best place to deploy Snort sensors and Manager? PLease do send your expert commnets! 2. The switches don't have a port mirror, so how do I monitor traffic there? 3. What changes shall I make in the network diagram to implement the best possible solution? Note: Client doesnot want to spend anything extra on hardware. Waiting eagerly for reply. Regards, Bishan ________________________________________________________________________ Want to chat instantly with your online friends? Get the FREE Yahoo! Messenger http://uk.messenger.yahoo.com/ ------------------------------------------------------- This SF.Net email sponsored by: Free pre-built ASP.NET sites including Data Reports, E-commerce, Portals, and Forums are available now. Download today and enter to win an XBOX or Visual Studio .NET. http://aspnet.click-url.com/go/psa00100006ave/direct;at.asp_061203_01/01 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- IDS placement Always Bishan (Jul 07)
- Re: IDS placement Michael Boman (Jul 07)