?
Solved

Snort and PT bypass adapter

Posted on 2008-06-20
2
Medium Priority
?
615 Views
Last Modified: 2013-11-29
I'm using a Snort IDS for my company, which runs on CentOS. The system is working currently using a single tap, but I need to expand into several more subnets in the immediate future. Instead of installing several Us work of taps, my sales rep suggested that I use bridge or bypass cards. I'm not too familiar with anything beyond standard multi port network cards so I'd like some unbiased input on what to purchase.

So far, I like the look of the Intel PRO/1000 PF bypass cards. The automatic fail over to continue network operations looks great, and the ability to both monitor and shape traffic in the same location is appealing.  I've read about plenty of people using the general PRO/1000 PF family cards, but nothing I've read has anything specifically about these bypass cards.
Can I use these cards without writing up a specialized driver or using proprietary software? If not, what alternatives do I have?
0
Comment
Question by:timbrigham
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
2 Comments
 
LVL 6

Assisted Solution

by:clearacid
clearacid earned 300 total points
ID: 21868531
Sounds like you have snort on inline mode - IPS and using open source snort?  I've used the commerical version of snort - Sourcefire.  What they did is bind physical interfaces into a single virtual interface and setup that virtual interface to be monitored for intrusions.

I haven't tried this on open source snort before - but I will now - it sounds interesting.....  

Another alternatlive you could do is monitor your gateway - if you have a core switch or core router that distributes across multiple vlans.  Just span those ports into your snort box.
0
 
LVL 38

Accepted Solution

by:
Rich Rumble earned 1200 total points
ID: 21874059
If you have Cisco switches, Catalyst at least, you can do remote span sessions: http://www.cisco.com/warp/public/473/41.html#topic4-2 Or there are devices you can but to tie multiple span ports together
http://www.datacomsystems.com/solutions/span-port-aggregation.asp
If you are using snort inline, this won't work for you.
-rich
0

Featured Post

Put Machine Learning to Work--Protect Your Clients

Machine learning means Smarter Cybersecurity™ Solutions.
As technology continues to advance, managing and analyzing massive data sets just can’t be accomplished by humans alone. It requires huge amounts of memory and storage, as well as the high-speed power of the cloud.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Let's recap what we learned from yesterday's Skyport Systems webinar.
Check out the latest tech news, community articles, and expert highlights in August's newsletter.
Nobody understands Phishing better than an anti-spam company. That’s why we are providing Phishing Awareness Training to our customers. According to a report by Verizon, only 3% of targeted users report malicious emails to management. With compan…
This video Micro Tutorial shows how to password-protect PDF files with free software. Many software products can do this, such as Adobe Acrobat (but not Adobe Reader), Nuance PaperPort, and Nuance Power PDF, but they are not free products. This vide…
Suggested Courses
Course of the Month14 days, 6 hours left to enroll

770 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question