Snort mailing list archives

Snort and network taps


From: m.pedro () comcast net
Date: Wed, 2 Dec 2015 14:01:20 +0000 (UTC)



Could anyone confirm if the NIC setting “net.ipv4.conf.all.rp_filter = 0” is required for a snort install inspecting 
traffic fed from a network tap? 




The setting makes sense for network tap fed devices as it’s a one-way traffic flow and they cannot verify the sources 
from that NIC. The question is being brought up as “net.ipv4.conf.all.rp_filter = 1” is the more secure configuration 
option and these devices are not the same as the others. 




Thanks in advance. 
------------------------------------------------------------------------------
Go from Idea to Many App Stores Faster with Intel(R) XDK
Give your users amazing mobile app experiences with Intel(R) XDK.
Use one codebase in this all-in-one HTML5 development environment.
Design, debug & build mobile apps & 2D/3D high-impact games for multiple OSs.
http://pubads.g.doubleclick.net/gampad/clk?id=254741911&iu=/4140
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Current thread: