Re: Sniffing split connections

[Tony Carter <tcarter () entrusion com>]

On Monday 11 April 2005 12:37 pm, Chris Mills wrote:
> Hi all-
>
> Here's the problem I'm having:
>
> I have a client site that has two physical connections from its ATM
> switch that connect to two different providers. The ATM switch uses
> both connections all the time (not set up as a failover.) The ATM
> switch at the site will not let me mirror the ports so I can't sniff
> there... and after the two providers, the connection is too fast for
> my equipment. I am using Snort 2.3.2 on PowerEdge 1750's. If I place a
> sniffer at both provider A and provider B, is there a way I can
> reassemble the traffic so I can see complete sessions? The two
> providers are on different sides of town.

Chris,
If your using Linux, try channel bonding both interfaces into one that you run 
snort against.

HTH,
Tony

--------------------------------------------------------------------------
Stop hurting your network!
 
The NeVO passive vulnerability sensor continuously finds vulnerabilities, 
applications and new hosts without the need for network scanning. 
It also finds compromised systems with application-based intrusion detection. 
Go to http://www.tenablesecurity.com/products/nevo.shtml to learn more.
--------------------------------------------------------------------------