IDS mailing list archives
RE: port mirroring for two targets
From: Luis Lopez Sanchez <luis.lopez () atosorigin com>
Date: Thu, 19 Jul 2007 20:53:08 +0200
Hi IDS-ers, For more understanding for using taps and span/mirroring ports in low cost switching infrastructure, see this very interesants links from TaoSecurity Blog: http://taosecurity.blogspot.com/2005/12/taps-and-hubs-never-ever-mix-ive.html http://taosecurity.blogspot.com/2005/12/taps-and-hubs-part-deux-yesterday-i.html Note: In standard network infrastructure, such as Enterasys or Cisco is normally possible to use several ports to span even remote-span. In low cost or old switches is not possible. Have luck! Regards, -- Luislo http://luislo.blogspot.com "I speak for myslef not Atos Origin" -----Original Message----- From: listbounce () securityfocus com on behalf of Andrew Hay Sent: Wed 18/07/2007 20:46 To: JGolian () seznam cz Cc: focus-ids () securityfocus com Subject: Re: port mirroring for two targets It depends on the make and model of the device you're trying to create the mirrored port on. Some devices don't allow you to create more than one mirrored interface for a particular port. You may also want to look at getting a network tap which would probably allow you to monitor a particular interface with multiple sensors. Hope this helps. On 18 Jul 2007 11:41:15 -0000, JGolian () seznam cz <JGolian () seznam cz> wrote:
I need port mirrored data for snort and for ntop. How to make it? Is possible to create two mirroring ports? ------------------------------------------------------------------------ Test Your IDS Is your IDS deployed correctly? Find out quickly and easily by testing it with real-world attacks from CORE IMPACT. Go to http://www.coresecurity.com/index.php5?module=Form&action=impact&campaign=intro_sfw to learn more. ------------------------------------------------------------------------
-- Andrew Hay blog: https://www.andrewhay.ca email: andrewsmhay || at || gmail.com ------------------------------------------------------------------------ Test Your IDS Is your IDS deployed correctly? Find out quickly and easily by testing it with real-world attacks from CORE IMPACT. Go to http://www.coresecurity.com/index.php5?module=Form&action=impact&campaign=intro_sfw to learn more. ------------------------------------------------------------------------ ------------------------------------------------------------------ This e-mail and the documents attached are confidential and intended solely for the addressee; it may also be privileged. If you receive this e-mail in error, please notify the sender immediately and destroy it. As its integrity cannot be secured on the Internet, the Atos Origin group liability cannot be triggered for the message content. Although the sender endeavours to maintain a computer virus-free network, the sender does not warrant that this transmission is virus-free and will not be liable for any damages resulting from any virus transmitted. Este mensaje y los ficheros adjuntos pueden contener informacion confidencial destinada solamente a la(s) persona(s) mencionadas anteriormente. Pueden estar protegidos por secreto profesional Si usted recibe este correo electronico por error, gracias de informar inmediatamente al remitente y destruir el mensaje. Al no estar asegurada la integridad de este mensaje sobre la red, Atos Origin no se hace responsable por su contenido. Su contenido no constituye ningun compromiso para el grupo Atos Origin, salvo ratificacion escrita por ambas partes. Aunque se esfuerza al maximo por mantener su red libre de virus, el emisor no puede garantizar nada al respecto y no sera responsable de cualesquiera danos que puedan resultar de una transmision de virus ------------------------------------------------------------------ ------------------------------------------------------------------------ Test Your IDS Is your IDS deployed correctly? Find out quickly and easily by testing it with real-world attacks from CORE IMPACT. Go to http://www.coresecurity.com/index.php5?module=Form&action=impact&campaign=intro_sfw to learn more. ------------------------------------------------------------------------
Current thread:
- port mirroring for two targets JGolian (Jul 18)
- Re: port mirroring for two targets Andrew Hay (Jul 19)
- RE: port mirroring for two targets Luis Lopez Sanchez (Jul 19)
- RE: port mirroring for two targets Stephane Boulet (Jul 19)
- RE: port mirroring for two targets Phillip Oliven (Jul 19)
- Re: port mirroring for two targets Dogten (Jul 19)
- RE: port mirroring for two targets Koch, Christian (Jul 19)
- Re: port mirroring for two targets Andrew Hay (Jul 19)