Snort mailing list archives
Re: heavily switched network questions
From: "Josh Berry" <josh.berry () linknet-solutions com>
Date: Tue, 30 Dec 2003 19:57:18 -0600 (CST)
You cannot effectively monitor the network without swapping the switches for ones that support spanning or running snort on every machine. The only way to halfway do it is hammer the switch you have with a tool that forces the switch to behave like a hub which makes the switch pointless. The best solution is to replace the current switches with ones that have port mirroring.
I've looked into this ad can't seem to find an answer I like. Perhaps I'm asking the wrong question. Suppose I have a network consisting of a gateway which goes into a firewall. The connection from the firewall goes into a switch which leads to another level of switches. some of these machines are servers, some are workstations. None of the switches have port mirroring (SPAN ports). I understand how to set us IDS at the gateway with a stealth interface. My question becomes, how do I effectively monitor the network. If I put a tap before each switch, I will not be able to monitor traffic between 2 machines on the other side of the switch, correct? do I have to run a snort sensor on each server? On each workstation? Ideally, I'd like to have one sensor for each segment without having to basically throw away existing hardware and get SPAN switches. Stewart -- Stewart Larsen <stl19847 () yahoo com> ------------------------------------------------------- This SF.net email is sponsored by: IBM Linux Tutorials. Become an expert in LINUX or just sharpen your skills. Sign up for IBM's Free Linux Tutorials. Learn everything from the bash shell to sys admin. Click now! http://ads.osdn.com/?ad_id=1278&alloc_id=3371&op=click _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
------------------------------------------------------- This SF.net email is sponsored by: IBM Linux Tutorials. Become an expert in LINUX or just sharpen your skills. Sign up for IBM's Free Linux Tutorials. Learn everything from the bash shell to sys admin. Click now! http://ads.osdn.com/?ad_id=1278&alloc_id=3371&op=click _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- heavily switched network questions Stewart Larsen (Dec 30)
- Re: heavily switched network questions Josh Berry (Dec 31)
- <Possible follow-ups>
- Re: heavily switched network questions Josh Berry (Dec 30)
- RE: heavily switched network questions SRH-Lists (Dec 31)