Snort mailing list archives
Re: Snort and network taps
From: "Mike Pedro" <m.pedro () comcast net>
Date: Mon, 7 Dec 2015 08:41:00 -0500
Hello Everyone, In my hurry to send my original email, I didn’t identify myself, my apologies. If anyone can provide any information on the need for the “net.ipv4.conf.all.rp_filter = 0” setting when using networks taps, it would be much appreciated. Thanks, Mike P. From: m.pedro () comcast net <mailto:m.pedro () comcast net> [mailto:m.pedro () comcast net] Sent: Wednesday, December 02, 2015 9:01 AM To: snort-users () lists sourceforge net <mailto:snort-users () lists sourceforge net> Subject: [Snort-users] Snort and network taps Could anyone confirm if the NIC setting “net.ipv4.conf.all.rp_filter = 0” is required for a snort install inspecting traffic fed from a network tap? The setting makes sense for network tap fed devices as it’s a one-way traffic flow and they cannot verify the sources from that NIC. The question is being brought up as “net.ipv4.conf.all.rp_filter = 1” is the more secure configuration option and these devices are not the same as the others. Thanks in advance.
------------------------------------------------------------------------------ Go from Idea to Many App Stores Faster with Intel(R) XDK Give your users amazing mobile app experiences with Intel(R) XDK. Use one codebase in this all-in-one HTML5 development environment. Design, debug & build mobile apps & 2D/3D high-impact games for multiple OSs. http://pubads.g.doubleclick.net/gampad/clk?id=254741911&iu=/4140
_______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users Please visit http://blog.snort.org to stay current on all the latest Snort news!
Current thread:
- Snort and network taps m . pedro (Dec 02)
- Message not available
- Re: Snort and network taps Mike Pedro (Dec 07)
- Message not available