Re: [ASK] Silent Interface??

[Joel Esler <joel.esler () sourcefire com>]

A tap is usually external to the box.  http://en.wikipedia.org/wiki/Network_tap

Traffic flows through the tap and the tap copies the traffic and sends  
it to the sensor.

--
Joel Esler
joel.esler () sourcefire com




On Dec 21, 2007, at 9:20 PM, Rachmat Hidayat Al-Anshar wrote:

> Ok..
> Network taps and port mirroring..
>
> I think I understand how the port mirroring works, but, for network  
> tap, how can I do this technically?
> um..the cable that used for tapping, is it connecting the sensor  
> interface with port on the switch? or what?
>
> In this case, I has already configured the sensor to communicate  
> with active response agent locate in the firewall.
> So I need to assign an IP address to the interface connected to  
> gateway (also operate as firewall).
>
> I use TSL (Trustix Secure Linux) as a sensor, firewall, and servers.  
> How can I make the sensor interface unassigns
> (without IP assigned), AFAIK, the other choices if we didn't  
> statically assign the IP address is DHCP. How about this?
>
>
> ----- Original Message ----
> From: JJC <cummingsj () gmail com>
> To: snort <Snort-users () lists sourceforge net>
> Sent: Wednesday, December 19, 2007 10:09:12 PM
> Subject: Re: [Snort-users] [ASK] Silent Interface??
>
> A second option would be to use port mirroring (or in  the Cisco  
> world "SPAN"), this assumes that your switches support this  
> feature.  In either the tap or port mirror scenario, the listening  
> interface(s) do not need DHCP or an IP address configured. It is, in  
> fact, generally recommended that you not have an address assigned to  
> the interface that will be sniffing the traffic.  That said, you  
> typically will have two or more interfaces on your snort box, one  
> for doing the sniffing (this one without an ip and connected to the  
> mirrored port) and the other for management of the system itself and  
> connected to your internal network .
>
> Cheers,
> JJC
> http://global-security.blogspot.com
>
> On Dec 19, 2007 8:20 AM, Gould, Scott < scott.gould () gogstats org>  
> wrote:
> Mat,
>
> You can place network taps between the gateway and switch in your  
> diagram.  These taps have a monitor port that will connect to the  
> sensor, and in turn send a copy of all the traffic seen by the tap  
> to the sensor.
>
> Scott Gould
> Senior Network & Systems Analyst
> Gynecologic Oncology Group
> Statistical & Data Center
> scott dot gould at gogstats dot org
>
> From: snort-users-bounces () lists sourceforge net [mailto:snort-users-bounces () lists sourceforge net 
> ] On Behalf Of Rachmat Hidayat Al-Anshar
> Sent: Tuesday, December 18, 2007 11:10 PM
> To: snort
> Subject: [Snort-users] [ASK] Silent Interface??
>
> Hi guys...
>
> Straightforward, I just wanna know deeper about "silent interface"  
> that we might use on sensors.
> I have a topology like this:
>
>                                         y
> INTERNET ---- gateway ----- sensor
>                          |                | x
>                          |                |
>                          +-------- switch --------- gateway -------  
> INTRANET
>                                            |
>                                            |
>                                   -------------
>                                   |       |       |
>                                 (servers on DMZ)
>
> is it true that we can use the sensor interface silently monitoring  
> the traffic flowing accross the switch ?
> (marked with x)??
>
> if the answers is correct, then how can i do that??
>
> is it with use the dhcp on in? or what??
>
> Thanks in advance
> Any response will greatly appreciated
> Mat (^^)
>
> Be a better friend, newshound, and know-it-all with Yahoo! Mobile.  
> Try it now.
>
> -------------------------------------------------------------------------
> SF.Net email is sponsored by:
> Check out the new SourceForge.net Marketplace.
> It's the best place to buy or sell services
> for just about anything Open Source.
> http://ad.doubleclick.net/clk;164216239;13503038;w?http://sf.net/marketplace
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users
>
>
>
> Looking for last minute shopping deals? Find them fast with Yahoo!  
> Search 
> .-------------------------------------------------------------------------
> This SF.net email is sponsored by: Microsoft
> Defy all challenges. Microsoft(R) Visual Studio 2005.
> http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/_______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users

-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2005.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users