Re: honeypot+ids?

[Jose Nazario <jose () monkey org>]

On Mon, 11 Aug 2003, Patrick Dolan wrote:

> I find it easiest to set up the router/switch as a computer rather than
> just a piece of hardware.  OpenBSD, for instance, has good capabilities
> for packet filtering.  With this method, you can run the IDS on the
> router and have it listen to the internal interface.  I've used OpenBSD
> in combination with Snort for this scenario and it works well.

log all packets that come through and have snort listen on pflog0 or use
the pf command "dup-to" to duplicate packets to the sensor. easy as pie.

___________________________
jose nazario, ph.d.                     jose () monkey org
                                        http://monkey.org/~jose/