Snort mailing list archives
Problem's with my snort DMZ sensor in another city
From: Seth Art <adidas30 () yahoo com>
Date: Tue, 20 Jul 2004 13:51:14 -0700 (PDT)
Hello everyone. This question is more of an architecture/environment problem than a snort problem, but i am hoping you can help. I have my DMZ switch which is a managed 3comm switch mirroring all DMZ traffic to a stealth interface on my snort sensor. I am sending alerts to a database/management server though my other interface on our local LAN subnet. Everything works great. We also have a office in another city without IT staff. I built another sensor that we want to deploy in on the DMZ in that city. Same type of managed 3comm switch. Both offices are connected though a frame relay cloud. I can ssh into the sensor though the LAN connected side. Because they don't have IT staff we tested a solution here before we send it out where I temporarily assigned the DMZ homed interface an IP address on the DMZ subnet, so i can manage that switch from my city (to initially set up port mirroring) and then quickly bring the interface back to stealth mode and keep it there. My problem is that the when i give the stealth interface an IP address on the DMZ subnet and try to ping the webserver or anything else on the DMZ (don't worry, i am doing a ping -I eth1 to ping from the DMZ homed interface) i get destination unreachable. I finally called someone there and had them jump on the webserver and try to ping the temp IP DMZ address i gave the snort sensor and they got no reply also. According to my contact in that office I do have a link light on both the LAN card and the DMZ card of the snort sensor. So far does anything pop out at you guys that I am missing. I did pre-test while that sensor machine and that switch were here before i sent it out. The switch is working correctly because the web and mail severs are working fine. Short of a bad cable or damaged card, I have run out of ideas. Can anyone shed some light? Thanks for your time. I know its kind of a long involved question but I have run out of ideas and feel helpless because i have to bother someone each time i need them to troubleshoot with me. -Seth ===== REPLY TO: adidas3 () optonline net __________________________________ Do you Yahoo!? Vote for the stars of Yahoo!'s next ad campaign! http://advision.webevents.yahoo.com/yahoo/votelifeengine/ ------------------------------------------------------- This SF.Net email is sponsored by BEA Weblogic Workshop FREE Java Enterprise J2EE developer tools! Get your free copy of BEA WebLogic Workshop 8.1 today. http://ads.osdn.com/?ad_id=4721&alloc_id=10040&op=click _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Snort Statistics Real Cucumber (Jul 08)
- <Possible follow-ups>
- RE: Snort Statistics Kreimendahl, Chad J (Jul 08)
- Problem's with my snort DMZ sensor in another city Seth Art (Jul 20)