Re: Multi-sensor setup

[Chris Jacob <cjacob () sourcefire com>]

To me it seems more like tasting water as it flows into a water
treatment plant, and again after it comes out....

:)

~c


On Wed, Jul 22, 2009 at 5:13 PM, Scott Elgram<SElgram () verifpoint com> wrote:
> I would like to see the traffic that is attempting to get through as well
> just so I know what sort of attacks or whatever is being attempted against
> my firewall.  As far as I know everything is hunky dory and anything
> malicious isn't getting through but it's a bit like standing at the edge of
> a dark hole.  Sure, I'm fine where I am now but I have no iea what's in the
> hole.
>
> -Scott
>
> -----Original Message-----
> From: Joel Esler [mailto:jesler () sourcefire com]
> Sent: Wednesday, July 22, 2009 2:05 PM
> To: SElgram () VerifPoint com
> Cc: Richard Bejtlich; <snort-users () lists sourceforge net>
> Subject: Re: [Snort-users] Multi-sensor setup
>
> Okay, I'll ask. Why do you want to compare traffic getting through?
> Just sniff behind the firewall and then you know what's getting through.
>
> --
> Sent from my iPhone
>
> On Jul 22, 2009, at 3:13 PM, "Scott Elgram" <SElgram () VerifPoint com>
> wrote:
>
> > Ideally I was thinking of attaching one interface just before my
> > firewall on
> > the internet side and the other just after the firewall on the
> > internal
> > network side.  I'd like to be able to view both the traffic that is
> > attempting to get through the firewall on both sides and by
> > comparison see
> > what traffic is making it through.  I'm relatively new to snort so
> > I'm not
> > entirely sure if this is even a logical setup but I figured it was
> > worth a
> > try.
> >
> > -Scott
> >
> > -----Original Message-----
> > From: Richard Bejtlich [mailto:taosecurity () gmail com]
> > Sent: Wednesday, July 22, 2009 12:07 PM
> > To: SElgram () verifpoint com; snort-users () lists sourceforge net
> > Subject: Re: [Snort-users] Multi-sensor setup
> >
> > Hello,
> >
> > What do you expect to have xl0 and xl1 monitor?
> >
> > Richard
> >
> > On 7/22/09, Scott Elgram <SElgram () verifpoint com> wrote:
> > > Hello,
> > >
> > >            I have recently completed a Snort install on FreeBSD but
> > > I'm
> > > unable to get it to do what I would like.  I have 3 interface cards
> > > installed (fxp0, xl0, xl1) and my plan is to set up fxp0 with an IP
> > address
> > > for BASE and leave the other two as Snort sensors without IP
> > > addresses in
> > > "promisc -arp" mode.
> > >
> > > If I set snort_interface to either xl0 or xl1 Snort runs perfectly
> > > fine
> > for
> > > the assigned interface but not at all for the unassigned interface,
> > > obviously.  After some digging I found some posts that stated I could
> > > accomplish my goal by bridging the two interfaces, which I have
> > > done with
> > > the following in my rc.conf file:
> > >
> > > ----------------------------------
> > >
> > > cloned_interfaces="bridge0"
> > >
> > > ifconfig_bridge0="addm xl0 addm xl1 up"
> > >
> > > ifconfig_xl0="up promisc -arp"
> > >
> > > ifconfig_xl1="up promisc -arp"
> > >
> > > ----------------------------------
> > >
> > >
> > >
> > > However, this still does not log consistent data for the two
> > > networks.
> > With
> > > snort_interface set to xl0, I ping through the network connected to
> > > xl0
> > and
> > > I get all the data, if I ping through the network connected to xl1
> > > I only
> > > get two entries and then nothing after that.ever.  I get the same
> > > result
> > > with snort_interface set to bridge0.  Additionally, the 2 entries I
> > > do get
> > > from pinging through the xl1 network are logged as sensor xl0.
> > >
> > >
> > >
> > > Am I missing something, is this something snort can do?
> > >
> > >
> > >
> > > Thanks,
> > >
> > > -Scott
> >
> >
> >
> > ---
> > ---
> > ---
> > ---------------------------------------------------------------------
> > _______________________________________________
> > Snort-users mailing list
> > Snort-users () lists sourceforge net
> > Go to this URL to change user options or unsubscribe:
> > https://lists.sourceforge.net/lists/listinfo/snort-users
> > Snort-users list archive:
> > http://www.geocrawler.com/redir-sf.php3?list=snort-users
>
>
>
> ------------------------------------------------------------------------------
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users

------------------------------------------------------------------------------
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users