?
Solved

Snort and PT bypass adapter

Posted on 2008-06-20
2
Medium Priority
?
624 Views
Last Modified: 2013-11-29
I'm using a Snort IDS for my company, which runs on CentOS. The system is working currently using a single tap, but I need to expand into several more subnets in the immediate future. Instead of installing several Us work of taps, my sales rep suggested that I use bridge or bypass cards. I'm not too familiar with anything beyond standard multi port network cards so I'd like some unbiased input on what to purchase.

So far, I like the look of the Intel PRO/1000 PF bypass cards. The automatic fail over to continue network operations looks great, and the ability to both monitor and shape traffic in the same location is appealing.  I've read about plenty of people using the general PRO/1000 PF family cards, but nothing I've read has anything specifically about these bypass cards.
Can I use these cards without writing up a specialized driver or using proprietary software? If not, what alternatives do I have?
0
Comment
Question by:timbrigham
2 Comments
 
LVL 6

Assisted Solution

by:clearacid
clearacid earned 300 total points
ID: 21868531
Sounds like you have snort on inline mode - IPS and using open source snort?  I've used the commerical version of snort - Sourcefire.  What they did is bind physical interfaces into a single virtual interface and setup that virtual interface to be monitored for intrusions.

I haven't tried this on open source snort before - but I will now - it sounds interesting.....  

Another alternatlive you could do is monitor your gateway - if you have a core switch or core router that distributes across multiple vlans.  Just span those ports into your snort box.
0
 
LVL 38

Accepted Solution

by:
Rich Rumble earned 1200 total points
ID: 21874059
If you have Cisco switches, Catalyst at least, you can do remote span sessions: http://www.cisco.com/warp/public/473/41.html#topic4-2 Or there are devices you can but to tie multiple span ports together
http://www.datacomsystems.com/solutions/span-port-aggregation.asp
If you are using snort inline, this won't work for you.
-rich
0

Featured Post

 The Evil-ution of Network Security Threats

What are the hacks that forever changed the security industry? To answer that question, we created an exciting new eBook that takes you on a trip through hacking history. It explores the top hacks from the 80s to 2010s, why they mattered, and how the security industry responded.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

With the evolution of technology, we have finally reached a point where it is possible to have home automation features like having your thermostat turn up and door lock itself when you leave, as well as a complete home security system. This is a st…
It’s a season to be thankful, and we’re thankful for users like you who engage on site, solve technology problems, and network with others in the industry. What tech are we most thankful for? Keep reading.
The Email Laundry PDF encryption service allows companies to send confidential encrypted  emails to anybody. The PDF document can also contain attachments that are embedded in the encrypted PDF. The password is randomly generated by The Email Laundr…
We’ve all felt that sense of false security before—locking down external access to a database or component and feeling like we’ve done all we need to do to secure company data. But that feeling is fleeting. Attacks these days can happen in many w…
Suggested Courses

839 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question