Re: Snort and network taps

["Mike Pedro" <m.pedro () comcast net>]

Hello Everyone,

 

In my hurry to send my original email, I didn’t identify myself, my apologies.

 

If anyone can provide any information on the need for the “net.ipv4.conf.all.rp_filter = 0” setting when using networks 
taps, it would be much appreciated.

 

Thanks,

Mike P.

 

 

 

From: m.pedro () comcast net <mailto:m.pedro () comcast net>  [mailto:m.pedro () comcast net] 
Sent: Wednesday, December 02, 2015 9:01 AM
To: snort-users () lists sourceforge net <mailto:snort-users () lists sourceforge net> 
Subject: [Snort-users] Snort and network taps

 

Could anyone confirm if the NIC setting “net.ipv4.conf.all.rp_filter = 0” is required for a snort install inspecting 
traffic fed from a network tap?

 

The setting makes sense for network tap fed devices as it’s a one-way traffic flow and they cannot verify the sources 
from that NIC. The question is being brought up as “net.ipv4.conf.all.rp_filter = 1” is the more secure configuration 
option and these devices are not the same as the others.

 

Thanks in advance.

------------------------------------------------------------------------------
Go from Idea to Many App Stores Faster with Intel(R) XDK
Give your users amazing mobile app experiences with Intel(R) XDK.
Use one codebase in this all-in-one HTML5 development environment.
Design, debug & build mobile apps & 2D/3D high-impact games for multiple OSs.
http://pubads.g.doubleclick.net/gampad/clk?id=254741911&iu=/4140

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!