Snort mailing list archives
Re: How to setup inline
From: Eric Hines <eric.hines () appliedwatch com>
Date: Sun, 09 Apr 2006 19:48:53 -0500
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mike, Will has a good point here. I wouldn't run all the rulesets if this is an ISP and the bandwidth is high. Remember, if Snort-Inline can't keep up with the speeds you're at, its GOING to drop packets. We need to know a lot more than it just being a WISP :) Also, if Snort-Inline goes offline for any reason, your network WILL go down. When Applied Watch sells its Snort-Inline IPS appliance, we never sell it without a Net Optics Optical Bypass Switch. So I'd couple your IPS with the Optical Bypass Switch as it has a heartbeat packet that passes through the IPS. If it doesn't get the heartbeat packet back, it immediately begins redirecting traffic through the bypass switch to keep the network up and running. FYI: http://www.netoptics.com/products/product_family.asp?cid=8&Section=products&menuitem=8&filter=30 They have them for both Gigabit fiber, copper, and 10/100. Best Regards, Eric Hines, GCIA, CISSP CEO, President Applied Watch Technologies, LLC - --------------------------------------------- Eric Hines, GCIA, CISSP CEO, President Applied Watch Technologies, LLC 1095 Pingree Road Suite 213 Crystal Lake, IL 60014 Toll Free: (877) 262-7593 ext:327 Direct: (847) 854-2725 ext:327 Fax: (847) 854-5106 Web: http://www.appliedwatch.com Email: eric.hines () appliedwatch com - -------------------------------------------- "Enterprise Open Source Security Management" Will Metcalf wrote:
On 4/9/06, Mike Montgomery <mmontgomery () c3bb com> wrote:What would the hardware requirements be on a system to run inline for snort? Will be using it at the headend of a WISP, with currently approx 850 customers. I have a AMD Sempron +1800 with 1gb ram and 2 80gb hdds setup in Raid0. Will that be sufficient to handle the load?Errr this is a relative question.... Are you going to allow the use of highly interactive protocols? What are you going to be doing reassembly on? How much of the traffic you are performing reassembly on makes up the total amount of traffic. What rulesets will be enabled? More importantly what is the size of the connection you are going to be running snort through? If you are just guarding a T1,DSL,or a small ATM connection or something this should be fine, but you won't know until you try it ;-) Regards, WillMike Eric Hines wrote:Mike, Answer 1) Yes, you will want (3) NICs on your box. Pop a new NIC in there. When you bridge it, you will have br0 for example, which will comprise a bridge of eth1 and eth2. Make eth0 your management interface and give it an IP. eth0: 192.168.0.1 eth1: 0.0.0.0 eth2. 0.0.0.0 Answer 2) Snort-Inline uses netfilter, ipqueue, etc for dropping packets. Their are numerous writeups on how to set this up. Answer 3) Specifying which attacks are dropped is done using the drop, sdrop, etc. keywords in the action of the individual signature. I hope this helps. Best Regards, Eric Hines, GCIA, CISSP CEO, President Applied Watch Technologies, LLC --------------------------------------------- Eric Hines, GCIA, CISSP CEO, President Applied Watch Technologies, LLC 1095 Pingree Road Suite 213 Crystal Lake, IL 60014 Toll Free: (877) 262-7593 ext:327 Direct: (847) 854-2725 ext:327 Fax: (847) 854-5106 Web: http://www.appliedwatch.com Email: eric.hines () appliedwatch com -------------------------------------------- "Enterprise Open Source Security Management" Mike Montgomery wrote:Hello, I recently setup a box running snort at our headend, its not inline as of now, but its using a monitor port on a cisco 2950. What would be the ideal setup to put the box inline? I currently have 2 nics in this box, 1 on the monitor port, 2nd is the nic I use to connect to the box for console. To go inline, would I need 3 nics total, 1 in, 1 out, and set them to be bridged? Or what. If I wanted snort to drop the packets for say P2P, would snort do that by itself, or would I need to have a firewall running to do that. Just trying to make some sense of this. Thanks Mike Montgomery Citizens Communications Corp. /Systems Administrator/ ------------------------------------------------------- This SF.Net email is sponsored by xPML, a groundbreaking scripting language that extends applications into web and mobile media. Attend the live webcast and join the prime developer group breaking into this new coding territory! http://sel.as-us.falkag.net/sel?cmd=lnk&kid=110944&bid=241720&dat=121642 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users------------------------------------------------------- This SF.Net email is sponsored by xPML, a groundbreaking scripting language that extends applications into web and mobile media. Attend the live webcast and join the prime developer group breaking into this new coding territory! http://sel.as-us.falkag.net/sel?cmd=lnk&kid=110944&bid=241720&dat=121642 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
------------------------------------------------------- This SF.Net email is sponsored by xPML, a groundbreaking scripting language that extends applications into web and mobile media. Attend the live webcast and join the prime developer group breaking into this new coding territory! http://sel.as-us.falkag.net/sel?cmd=k&kid0944&bid$1720&dat1642 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=ort-users
-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.2 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFEOat1bOqF2QHgUK0RAltuAJ44HNffqlO88cpg+khncyAiAo9bRQCaAitJ MAJ+EahXI/kktJzn5srOJrY= =Fcf7 -----END PGP SIGNATURE----- ------------------------------------------------------- This SF.Net email is sponsored by xPML, a groundbreaking scripting language that extends applications into web and mobile media. Attend the live webcast and join the prime developer group breaking into this new coding territory! http://sel.as-us.falkag.net/sel?cmd=lnk&kid=110944&bid=241720&dat=121642 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- How to setup inline Mike Montgomery (Apr 07)
- Re: How to setup inline Eric Hines (Apr 07)
- Re: How to setup inline Mike Montgomery (Apr 09)
- Re: How to setup inline Will Metcalf (Apr 09)
- Re: How to setup inline Eric Hines (Apr 09)
- Re: How to setup inline Mike Montgomery (Apr 09)
- Re: How to setup inline Mike Montgomery (Apr 09)
- Re: How to setup inline Eric Hines (Apr 09)
- Re: How to setup inline Mike Montgomery (Apr 09)
- Re: How to setup inline Will Metcalf (Apr 10)
- Re: How to setup inline Eric Hines (Apr 07)