Solved

Snort and PT bypass adapter

Posted on 2008-06-20
2
611 Views
Last Modified: 2013-11-29
I'm using a Snort IDS for my company, which runs on CentOS. The system is working currently using a single tap, but I need to expand into several more subnets in the immediate future. Instead of installing several Us work of taps, my sales rep suggested that I use bridge or bypass cards. I'm not too familiar with anything beyond standard multi port network cards so I'd like some unbiased input on what to purchase.

So far, I like the look of the Intel PRO/1000 PF bypass cards. The automatic fail over to continue network operations looks great, and the ability to both monitor and shape traffic in the same location is appealing.  I've read about plenty of people using the general PRO/1000 PF family cards, but nothing I've read has anything specifically about these bypass cards.
Can I use these cards without writing up a specialized driver or using proprietary software? If not, what alternatives do I have?
0
Comment
Question by:timbrigham
2 Comments
 
LVL 6

Assisted Solution

by:clearacid
clearacid earned 100 total points
ID: 21868531
Sounds like you have snort on inline mode - IPS and using open source snort?  I've used the commerical version of snort - Sourcefire.  What they did is bind physical interfaces into a single virtual interface and setup that virtual interface to be monitored for intrusions.

I haven't tried this on open source snort before - but I will now - it sounds interesting.....  

Another alternatlive you could do is monitor your gateway - if you have a core switch or core router that distributes across multiple vlans.  Just span those ports into your snort box.
0
 
LVL 38

Accepted Solution

by:
Rich Rumble earned 400 total points
ID: 21874059
If you have Cisco switches, Catalyst at least, you can do remote span sessions: http://www.cisco.com/warp/public/473/41.html#topic4-2 Or there are devices you can but to tie multiple span ports together
http://www.datacomsystems.com/solutions/span-port-aggregation.asp
If you are using snort inline, this won't work for you.
-rich
0

Featured Post

Master Your Team's Linux and Cloud Stack

Come see why top tech companies like Mailchimp and Media Temple use Linux Academy to build their employee training programs.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

It’s the first day of March, the weather is starting to warm up and the excitement of the upcoming St. Patrick’s Day holiday can be felt throughout the world.
OnPage: Incident management and secure messaging on your smartphone
Learn how to find files with the shell using the find and locate commands. Use locate to find a needle in a haystack.: With locate, check if the file still exists.: Use find to get the actual location of the file.:
With Secure Portal Encryption, the recipient is sent a link to their email address directing them to the email laundry delivery page. From there, the recipient will be required to enter a user name and password to enter the page. Once the recipient …

820 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question