Re: reassemble data from TAP

[Kyle Maxwell <krmaxwell () gmail com>]

On Thu, 14 Oct 2004 10:17:09 +0600, Vladislav V. Myasnyankin
<mvv () kazna ru> wrote:
> I want to use Snort (on Linux box)  to analyze network flow to/from
> honeynet. But I have some restrictions, especially I can use only Single TAP
> (http://www.securicore.ca/critical_taps/singletap/ ) to connect sensors. This
> mean, that I need 2 NIC to receive full stream (one for Rx, one for Tx
> pair). I am not sure, if Snort will work well in these conditions, because
> each sensor can analyze only half of the stream.
> Is there any software solution for Linux to "restore" full stream, direct it
> to some pseudo-NIC, then "connect" snort to this pseudo-NIC?

Look around for "Linux channel bonding" and "interface aggregation";
that lets you aggregate multiple physical interfaces into one virtual
interface. Then point your IDS, sniffer, or whatever at the new
virtual interface.

-- 
Kyle Maxwell
[krmaxwell () gmail com]