Re: Newbie question - I did read the FAQ first.

[stephane nasdrovisky <stephane.nasdrovisky () paradigmo com>]

Mike Lieberman wrote:

> Sorry about this use of bandwidth, but we are planning out our first
> implementation of SNORT
If it's your 1st snort implementation, keep it simple, setup complex 
sensors when you are 'fluent' in snort, acid, ...

> and after reading some of the DOCs and reviewing the
> FAQ we have a TAP hardware question.
>
> In Brian Laing's excellent "How To Guide: Intrusion Detection Systems" he
> states that "Without extra modifications the solution cannot monitor traffic
> in both directions" [page 11] and "Terminate Sessions: Since Taps only allow
> traffic to flow in one direction the IDS cannot terminate sessions" [page
> 17]
>  
These taps make sure the sensor do not send information over the 
network, you may consider it is a kind of security measure. Sending and 
receiving packets do not need a tap, you need a network connection (and 
a little configuration of your switch if you have one and want to be 
able to monitor traffic not targuetting your sensor. this feature is 
sometimes called port mirroring or port monitoring)

> I have been looking at two Active Taps (such as the NCT1C) in which the
> manufacturers indicate that both directions are sent to the IDS system.
>
> Is this type of Tap compatible with SNORT?
>  
Yes, the sensor will receive the whole traffic, which is fine. If you 
want to send packets over the network (for an acid db or for killing tcp 
sessions), you need a device with such capabilities (a switch, for 
example),or you'll need a 3rd nic for sending packets (this later one 
have to be plugged into your network, not a one direction tap).

> If yes, is the information on "Terminate Sessions" on page 17 still accurate
> with the need for two Taps and a Top Layer Switch or can it be done with
> this type of single Active Tap?
>  
Basically, terminating a session requires snort to send packets, the tab 
you describe only alows your sensor to receive packet, make your own 
conclusion on your needs..

> Also, there is a Datacom Systems' SINGLEstream which has Two Taps, both of
> which "combine the two data streams, allowing any connected 10/100
> monitoring device to receive a full-duplex stream of data with one NIC."
> Could this be used for bi-directional Kills? 
>
>  
I guess it's more expensive than adding a second NIC in your 
sensor(there is an existing linux driver allowing you to combine the 2 
incoming streams into a virtual NIC, which seems about the same as the 
datacom solution) The solution looks nice (although additional 
hardware=,in my mind, additional failures), but I would probably opt for 
a more simple linux/bsd solution with a lot of NICs (there  are some 
quad ethernets, just in case). If your budget is limited, you could even 
use the same box fox firewalling, IDS, proxy, mail gateway(with av),.... 
In order to keep it simple, begins to setup your new box as a stupid 
router, add features when you're confident with your previous setup, try 
not to be too fast. If you need 1 year to get the box configured as you 
want, it's better than nothing.




-------------------------------------------------------
SF.Net email is sponsored by Shop4tech.com-Lowest price on Blank Media
100pk Sonic DVD-R 4x for only $29 -100pk Sonic DVD+R for only $33
Save 50% off Retail on Ink & Toner - Free Shipping and Free Gift.
http://www.shop4tech.com/z/Inkjet_Cartridges/9_108_r285
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users