RE: IDS using Taps & network bridging

I think perhaps you want to sniff the external interface (eth1 or eth2) instead ?

Also, I agree with others that Linux isn't necessarily the best platform for doing this sort of thing. OpenBSD would work quite well.

I notice you didn't specifically mention inline snort ... have you looked at this ? (http://www.snort.org/dl/contrib/patches/inline/)

-----Original Message-----

From: oobs3c02@attbi.com [mailto:oobs3c02@attbi.com] Sent: Sunday, November 17, 2002 1:16 PM
To: focus-ids@securityfocus.com
Subject: IDS using Taps & network bridging

Hi,

I'm doing some testing to see how Taps could be implimented in my environment. I've read some information from Snort.org and other sources showing the use of taps in conjunction with a switch. I would like to eliminate the switch for the aggregation and I'm looking for ideas on how to do that. The IDS platform is snort running on Intel with Linux 2.4 Kernel. Ideas I've had so far are:

1. Hub - full duplex issues - scrapped that idea!
2. Bridged network cards - sniffing the bridged interface has been problematic. It works but there seems to be an ARP DoS - any ideas on this would be great!
3. Multi port NIC that has software to aggregate. The only solution I've found for this only has drivers for Windows.

I'm open to any suggestions but I'm really interested in the network bridging. What I've done so far is:
-Install 3 NICs in my box

I see mostly massive amounts of ARP traffic - any help on this would be appreciated.

Do you need help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related securityfocus.com Links bugtraq certification focus-bsd focus-ids focus-ih focus-linux focus-ms focus-sun focus-unix-other focus-virus forensics incidents libnet linux-secnews ms-secnews pen-test secpapers secprog sectools secureshell security-basics securityjobs sf-news vuln-dev webappsec Request more information about Pantek

Regards,

Jim

"Life's tough - but it's a whole lot tougher when your stupid!" Received on Tue Nov 26 19:46:51 2002