Solved

Snort and PT bypass adapter

Posted on 2008-06-20
2
603 Views
Last Modified: 2013-11-29
I'm using a Snort IDS for my company, which runs on CentOS. The system is working currently using a single tap, but I need to expand into several more subnets in the immediate future. Instead of installing several Us work of taps, my sales rep suggested that I use bridge or bypass cards. I'm not too familiar with anything beyond standard multi port network cards so I'd like some unbiased input on what to purchase.

So far, I like the look of the Intel PRO/1000 PF bypass cards. The automatic fail over to continue network operations looks great, and the ability to both monitor and shape traffic in the same location is appealing.  I've read about plenty of people using the general PRO/1000 PF family cards, but nothing I've read has anything specifically about these bypass cards.
Can I use these cards without writing up a specialized driver or using proprietary software? If not, what alternatives do I have?
0
Comment
Question by:timbrigham
2 Comments
 
LVL 6

Assisted Solution

by:clearacid
clearacid earned 100 total points
ID: 21868531
Sounds like you have snort on inline mode - IPS and using open source snort?  I've used the commerical version of snort - Sourcefire.  What they did is bind physical interfaces into a single virtual interface and setup that virtual interface to be monitored for intrusions.

I haven't tried this on open source snort before - but I will now - it sounds interesting.....  

Another alternatlive you could do is monitor your gateway - if you have a core switch or core router that distributes across multiple vlans.  Just span those ports into your snort box.
0
 
LVL 38

Accepted Solution

by:
Rich Rumble earned 400 total points
ID: 21874059
If you have Cisco switches, Catalyst at least, you can do remote span sessions: http://www.cisco.com/warp/public/473/41.html#topic4-2 Or there are devices you can but to tie multiple span ports together
http://www.datacomsystems.com/solutions/span-port-aggregation.asp
If you are using snort inline, this won't work for you.
-rich
0

Featured Post

How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

Join & Write a Comment

Password hashing is better than message digests or encryption, and you should be using it instead of message digests or encryption.  Find out why and how in this article, which supplements the original article on PHP Client Registration, Login, Logo…
Find out what Office 365 Transport Rules are, how they work and their limitations managing Office 365 signatures.
Learn several ways to interact with files and get file information from the bash shell. ls lists the contents of a directory: Using the -a flag displays hidden files: Using the -l flag formats the output in a long list: The file command gives us mor…
Learn how to navigate the file tree with the shell. Use pwd to print the current working directory: Use ls to list a directory's contents: Use cd to change to a new directory: Use wildcards instead of typing out long directory names: Use ../ to move…

759 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

26 Experts available now in Live!

Get 1:1 Help Now