Snort mailing list archives
Snort and network taps
From: m.pedro () comcast net
Date: Wed, 2 Dec 2015 14:01:20 +0000 (UTC)
Could anyone confirm if the NIC setting “net.ipv4.conf.all.rp_filter = 0” is required for a snort install inspecting traffic fed from a network tap? The setting makes sense for network tap fed devices as it’s a one-way traffic flow and they cannot verify the sources from that NIC. The question is being brought up as “net.ipv4.conf.all.rp_filter = 1” is the more secure configuration option and these devices are not the same as the others. Thanks in advance.
------------------------------------------------------------------------------ Go from Idea to Many App Stores Faster with Intel(R) XDK Give your users amazing mobile app experiences with Intel(R) XDK. Use one codebase in this all-in-one HTML5 development environment. Design, debug & build mobile apps & 2D/3D high-impact games for multiple OSs. http://pubads.g.doubleclick.net/gampad/clk?id=254741911&iu=/4140
_______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users Please visit http://blog.snort.org to stay current on all the latest Snort news!
Current thread:
- Snort and network taps m . pedro (Dec 02)
- Message not available
- Re: Snort and network taps Mike Pedro (Dec 07)
- Message not available