Re: [ASK] Silent Interface??

[JJC <cummingsj () gmail com>]

A second option would be to use port mirroring (or in  the Cisco world
"SPAN"), this assumes that your switches support this feature.  In either
the tap or port mirror scenario, the listening interface(s) do not need DHCP
or an IP address configured. It is, in fact, generally recommended that you
not have an address assigned to the interface that will be sniffing the
traffic.  That said, you typically will have two or more interfaces on your
snort box, one for doing the sniffing (this one without an ip and connected
to the mirrored port) and the other for management of the system itself and
connected to your internal network .

Cheers,
JJC
http://global-security.blogspot.com

On Dec 19, 2007 8:20 AM, Gould, Scott <scott.gould () gogstats org> wrote:

>  Mat,
>
> You can place network taps between the gateway and switch in your
> diagram.  These taps have a monitor port that will connect to the sensor,
> and in turn send a copy of all the traffic seen by the tap to the sensor.
>
>
> Scott Gould
>
> Senior Network & Systems Analyst
> Gynecologic Oncology Group
> Statistical & Data Center
> scott dot gould at gogstats dot org
>
>  ------------------------------
> *From:* snort-users-bounces () lists sourceforge net [mailto:
> snort-users-bounces () lists sourceforge net] *On Behalf Of *Rachmat Hidayat
> Al-Anshar
> *Sent:* Tuesday, December 18, 2007 11:10 PM
> *To:* snort
> *Subject:* [Snort-users] [ASK] Silent Interface??
>
>  Hi guys...
>
> Straightforward, I just wanna know deeper about "silent interface" that we
> might use on sensors.
> I have a topology like this:
>
>                                         y
> INTERNET ---- gateway ----- sensor
>                          |                | x
>                          |                |
>                          +-------- switch --------- gateway -------
> INTRANET
>                                            |
>                                            |
>                                   -------------
>                                   |       |       |
>                                 (servers on DMZ)
>
> is it true that we can use the sensor interface silently monitoring the
> traffic flowing accross the switch ?
> (marked with x)??
>
> if the answers is correct, then how can i do that??
>
> is it with use the dhcp on in? or what??
>
> Thanks in advance
> Any response will greatly appreciated
> Mat (^^)
>
> ------------------------------
> Be a better friend, newshound, and know-it-all with Yahoo! Mobile. Try it
> now.<http://us.rd.yahoo.com/evt=51733/*http://mobile.yahoo.com/;_ylt=Ahu06i62sR8HDtDypao8Wcj9tAcJ+>
>
> -------------------------------------------------------------------------
> SF.Net email is sponsored by:
> Check out the new SourceForge.net Marketplace.
> It's the best place to buy or sell services
> for just about anything Open Source.
>
> http://ad.doubleclick.net/clk;164216239;13503038;w?http://sf.net/marketplace
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users
-------------------------------------------------------------------------
SF.Net email is sponsored by:
Check out the new SourceForge.net Marketplace.
It's the best place to buy or sell services
for just about anything Open Source.
http://ad.doubleclick.net/clk;164216239;13503038;w?http://sf.net/marketplace

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users