Snort mailing list archives
Newbie question - I did read the FAQ first.
From: "Mike Lieberman" <Mike () netwright net>
Date: Mon, 23 Aug 2004 15:53:02 -0600
Sorry about this use of bandwidth, but we are planning out our first implementation of SNORT and after reading some of the DOCs and reviewing the FAQ we have a TAP hardware question. In Brian Laing's excellent "How To Guide: Intrusion Detection Systems" he states that "Without extra modifications the solution cannot monitor traffic in both directions" [page 11] and "Terminate Sessions: Since Taps only allow traffic to flow in one direction the IDS cannot terminate sessions" [page 17] I have been looking at two Active Taps (such as the NCT1C) in which the manufacturers indicate that both directions are sent to the IDS system. Is this type of Tap compatible with SNORT? If yes, is the information on "Terminate Sessions" on page 17 still accurate with the need for two Taps and a Top Layer Switch or can it be done with this type of single Active Tap? Also, there is a Datacom Systems' SINGLEstream which has Two Taps, both of which "combine the two data streams, allowing any connected 10/100 monitoring device to receive a full-duplex stream of data with one NIC." Could this be used for bi-directional Kills? ------------------------------------------------------- SF.Net email is sponsored by Shop4tech.com-Lowest price on Blank Media 100pk Sonic DVD-R 4x for only $29 -100pk Sonic DVD+R for only $33 Save 50% off Retail on Ink & Toner - Free Shipping and Free Gift. http://www.shop4tech.com/z/Inkjet_Cartridges/9_108_r285 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Updated to Snort 2.2.0 and now nothing is being written to Acid b7time b7time (Aug 23)
- Re: Updated to Snort 2.2.0 and now nothing is being written to Acid Paul Dokas (Aug 23)
- Newbie question - I did read the FAQ first. Mike Lieberman (Aug 23)
- Re: Newbie question - I did read the FAQ first. stephane nasdrovisky (Aug 23)
- Newbie question - I did read the FAQ first. Mike Lieberman (Aug 23)
- <Possible follow-ups>
- Re: Updated to Snort 2.2.0 and now nothing is being written to Acid b7time b7time (Aug 27)
- Re: Updated to Snort 2.2.0 and now nothing is being written to Acid Paul Dokas (Aug 23)