Snort mailing list archives
Re: Portscan on an Unaddressed sniffer port
From: Jeff Kell <jeff-kell () utc edu>
Date: Thu, 03 Nov 2005 22:12:24 -0500
Timothy A. Holmes wrote:
I need to do some sort of scan on an unaddressed sniffing interface on a SNORT box to test the installation to see if it is all working right. I have a port scanner on my UBUNTU laptop that I could use if I knew how to address the port. The management interface on the box (it's a FC4 box) is 192.168.0.28 and that's eth1 The unaddressed port is eth0 on the same box
Not sure if I understand your exact setup, but let me guess... If you have a network tap, just connect the unaddressed port to the tap, put the tap itself between the management interface and it's upstream switch/router/etc. Do your scan of any real machine from the management interface. The unaddressed port will see it. If you have a dumb hub (not a switch), plug both the unaddressed and management interfaces into the port, and connect the hub to whatever is upstream. Then scan as ablve. If you have a switch, setup a monitor/mirror/span port and hook the unaddressed interface to it, scan as above. That what you had in mind? You can't properly send traffic to the port at all -- you have to have to force traffic down it's throat at a much more primitive level. Jeff ------------------------------------------------------- SF.Net email is sponsored by: Tame your development challenges with Apache's Geronimo App Server. Download it for free - -and be entered to win a 42" plasma tv or your very own Sony(tm)PSP. Click here to play: http://sourceforge.net/geronimo.php _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Portscan on an Unaddressed sniffer port Timothy A. Holmes (Nov 03)
- Re: Portscan on an Unaddressed sniffer port Valter Santos (Nov 03)
- Re: Portscan on an Unaddressed sniffer port Jeff Kell (Nov 03)