Re: Any issues with dup packets on snort?

[G Ramon Gomez <gene () gomezbrothers com>]

Hi Jason,
It sounds like, rather than running multiple instances of snort in 
different places on your network, you're copying data from multiple 
locations on the network back to a single snort interface.
There's no real problem with a configuration like this.  You'll probably 
get duplicate detects, but you'd get that anyway if you were running 
multiple snort instances reporting back to a single location.

- Ramon

Jason Haar wrote:

> We have a range of switches being used within our network for port
> monitoring, and a couple have had to be set up in such a way that you
> can end up seeing each packet TWICE on the snort interface. I've been
> told by our network engineers that this has to be the case in order for
> the IDS to see the networks it needs to on one card.
>
> i.e.
>
> src-ip->dst-ip SYN
> dst-ip->src-ip SYN-ACK
>
> actually looks like
>
> src-ip->dst-ip SYN
> src-ip->dst-ip SYN
> dst-ip->src-ip SYN-ACK
> dst-ip->src-ip SYN-ACK
>
> Anyway, I have no problem with that, and snort "seems" to be happy too.
> Can someone confirm that duplicate packets aren't a problem? That
> worst-case should be duplicate alerts?
>  


-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems?  Stop!  Download the new AJAX search engine that makes
searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
http://ads.osdn.com/?ad_id=7637&alloc_id=16865&op=click
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users