Sniffing split connections

[Chris Mills <securinate () gmail com>]

Hi all-

Here's the problem I'm having:

I have a client site that has two physical connections from its ATM
switch that connect to two different providers. The ATM switch uses
both connections all the time (not set up as a failover.) The ATM
switch at the site will not let me mirror the ports so I can't sniff
there... and after the two providers, the connection is too fast for
my equipment. I am using Snort 2.3.2 on PowerEdge 1750's. If I place a
sniffer at both provider A and provider B, is there a way I can
reassemble the traffic so I can see complete sessions? The two
providers are on different sides of town.

               |--------|PROVIDER A|\
Client Site|                          |-----------|INTERNET|
               |--------|PROVIDER B|/

Thanks very much,

Chris

--------------------------------------------------------------------------
Stop hurting your network!
 
The NeVO passive vulnerability sensor continuously finds vulnerabilities, 
applications and new hosts without the need for network scanning. 
It also finds compromised systems with application-based intrusion detection. 
Go to http://www.tenablesecurity.com/products/nevo.shtml to learn more.
--------------------------------------------------------------------------