Re: can snort help detect bad spans?

[Jason Haar <Jason.Haar () trimble co nz>]

On 03/22/2011 12:57 PM, Jason Wallace wrote:
> I could be wrong, but I don't see how Snort could identify that type
> of issue. You would be better off monitoring the span port with Cacti
> and generating an alert when the port is at a high utilization level
> for a given amount of time.
What about my suggestion: getting error stats from stream5_tcp? If it
sees packet 1,2,3,6,9,11,45 in an existing TCP session, it's borked and
isn't going to be able to do a good job as a NIDS - making that
information available to the analyst would help not only with SPAN
issues, but with WAN issue detection too.

> Damn those network guys!

No comment ;-)

-- 
Cheers

Jason Haar
Information Security Manager, Trimble Navigation Ltd.
Phone: +64 3 9635 377 Fax: +64 3 9635 417
PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1


------------------------------------------------------------------------------
Enable your software for Intel(R) Active Management Technology to meet the
growing manageability and security demands of your customers. Businesses
are taking advantage of Intel(R) vPro (TM) technology - will your software 
be a part of the solution? Download the Intel(R) Manageability Checker 
today! http://p.sf.net/sfu/intel-dev2devmar
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users