Re: Snorting MS PPTP VPN

[Matt Kettler <mkettler () evi-inc com>]

At 01:33 PM 9/17/2004, Lyndon Tiu wrote:
> Is it possible to snort what goes through a MS PPTP VPN? I suspect viruses 
> are going through the VPN from one office site to another but can snort 
> help here?

Snort won't be able to decode what's inside your VPN.. If it could, your 
VPN would be pointless... Remember, the point of a VPN is to prevent people 
from knowing what's going through it.


Now, you could insert a snort sensor some place behind your firewall to see 
all the traffic after it's been decrypted.. Couple that with some rules 
from bleedingsnort and you could detect this kind of thing, but you're 
going to have to snort it before it enters the VPN tunnel.



-------------------------------------------------------
This SF.Net email is sponsored by: YOU BE THE JUDGE. Be one of 170
Project Admins to receive an Apple iPod Mini FREE for your judgement on
who ports your project to Linux PPC the best. Sponsored by IBM.
Deadline: Sept. 24. Go here: http://sf.net/ppc_contest.php
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users