Snort mailing list archives
Re: snort deployment
From: fname lname <larskman () gmail com>
Date: Tue, 30 Aug 2005 20:47:34 -0400
I was reading over snort deployment on snort's site what if i build a passive tap? Will that be the same? But look I need two nic in my box to use it on a full duplex mode. On 8/30/05, Will Metcalf <william.metcalf () gmail com> wrote:
Hmmmm I agree with David, if you are only going to be passively monitoring traffic (alerting) there is no need to run in inline mode. You will probably introduce some unnecessary latency into your network. I would investigate using a span port or a tap. Regards, Will On 8/30/05, David Klotz <bucky () speakeasy org> wrote:On Tue, 30 Aug 2005, MAEDA wrote:You should run snort as inline-mode (see manual version 2.3.x). In inline-mode, snort takes packet informations from target QUEUE ofiptables.So, you make bridge between two NICs, and assign QUEUE toFORWARD-chain target.Wouldn't inline just add another layer of complexity when it's notneeded? Iwould go with the switch and the span port, unless you have somespecific needfor inline, such as connection killing or any of the IPS stylefunctionality.But I'm no expert... -- -Dave -bucky () speakeasy org ------------------------------------------------------- SF.Net email is Sponsored by the Better Software Conference & EXPO September 19-22, 2005 * San Francisco, CA * Development LifecyclePracticesAgile & Plan-Driven Development * Managing Projects & Teams * Testing &QASecurity * Process Improvement & Measurement *http://www.sqe.com/bsce5sf_______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users------------------------------------------------------- SF.Net email is Sponsored by the Better Software Conference & EXPO September 19-22, 2005 * San Francisco, CA * Development Lifecycle Practices Agile & Plan-Driven Development * Managing Projects & Teams * Testing & QA Security * Process Improvement & Measurement * http://www.sqe.com/bsce5sf _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?listsnort-users
Current thread:
- snort deployment fname lname (Aug 29)
- RE: snort deployment Patrick Harper (Aug 29)
- Re: snort deployment MAEDA (Aug 29)
- Re: snort deployment David Klotz (Aug 30)
- Re: snort deployment Will Metcalf (Aug 30)
- Re: snort deployment fname lname (Aug 30)
- Re: snort deployment Jason Brvenik (Aug 30)
- Re: snort deployment David Klotz (Aug 30)