Solved

Which ports to monioter with IDS?

Posted on 2009-07-06
7
338 Views
Last Modified: 2013-11-29
Is it unreasonable to monitor uplink ports with snort? (via port monitoring in cisco switches)

For example, if I enabled port monitoring on the uplink that goes from our switch, to our firewall. Is it even worth monitoring this?  basically, I'm trying to gauge what ports should be monitored inside a network. What about DMZ? Looking for best practices here

Thanks
0
Comment
Question by:WERAracer
  • 4
  • 3
7 Comments
 
LVL 38

Expert Comment

by:Rich Rumble
Comment Utility
Monitoring incoming traffic from outside the firewall will be very chatty, monitor the inside interface if your only concerned with traffic the firewall does let through. If your interested in blocking active attacks, sniff the outside, if not, don't.
The best place single place to monitor is a trunk/uplink between switches or other gear. You can set your span session to include all traffic on all vlan's, or you can weed out vlan's or port's. We have enough gear and bandwidth being used we have to "tap" switch traffic with  Gigamon devices: http://www.gigamon.com/
If your not that big, you can make a few taps from multiple nic's, run one to each switch, or cisco's span sessions can be "cc'd" to central switches via RSPAN: http://www.cisco.com/en/US/products/hw/switches/ps708/products_tech_note09186a008015c612.shtml#topic4-2 Note depending on your through put, you could kill your uplink ports/trunks...
Again the span port can list multiple ports or vlan's, and depending on your switch you can have more than one span session on that switch.
-rich
0
 
LVL 1

Author Comment

by:WERAracer
Comment Utility
I have decided to do the SPAN route. How do I go about CCing the traffic via RSPAN. When you say I could kill uplink/ports, do you mean bandwidth wise? Is this possible to do on a 4507R?

I basically just need to monitor one VLAN (default vlan actually).  I have done this several times on 2950, 2900xls etc via the port monitor command. How do I do this in a 4507R

Thanks for the response Rich.
0
 
LVL 38

Accepted Solution

by:
Rich Rumble earned 500 total points
Comment Utility
http://www.cisco.com/en/US/docs/switches/lan/catalyst4500/12.1/13ew/configuration/guide/span.html#wp1032145
monitor session 1 source interface fastethernet 1/1
monitor session 1 filter vlan 1
monitor session 1 destination interface fastethernet 6/48
It does look like a 4000 series supports RSPAN
http://www.cisco.com/en/US/products/hw/switches/ps708/products_tech_note09186a008015c612.shtml#support
And yes I meant by topping out your available BW, so if you have 500mb to/from a switch and you want to send that much traffic over an rspan, a 1Gb link will be murdered ;)
-rich
0
How to improve team productivity

Quip adds documents, spreadsheets, and tasklists to your Slack experience
- Elevate ideas to Quip docs
- Share Quip docs in Slack
- Get notified of changes to your docs
- Available on iOS/Android/Desktop/Web
- Online/Offline

 
LVL 1

Author Comment

by:WERAracer
Comment Utility
thank you!

Question. We have vlans that obviously span several switches. If I just wanted to monitor VLAN 1 on our core switch, would this work:

monitor session 1 source vlan 1
monitor session 1 destination interface gig3/1

That would send ALL traffic in the default vlan to 3/1 (where my snort box is)?

Thanks
0
 
LVL 38

Expert Comment

by:Rich Rumble
Comment Utility
Yes I believe that will work, however I don't know the 4500 series that well, I've not seen those commands myself. Yes all traffic that your switch see's will be sent to that port. If the traffic exceeds 1gb, the traffic is dropped, sometimes queued and sent on, but if you rspan another switch the same way and that traffic exceeds your uplinks you'll have a lot of issues, and with that comes the re-transmission storm compounding the problem. I'm not sure of the RSPAN for that model, but it's probably in the cli help or tab completion.
-rich
0
 
LVL 38

Expert Comment

by:Rich Rumble
Comment Utility
To clarify, all traffic on vlan 1 that your core switch sees will be sent to the monitor port. If the BW of the monitor port is exceeded it will likely drop frames, won't cause problems but potentially makes the IDS miss packets. I personally like to have segregated sensors and span sessions. The switch doesn't work as hard, I can tell what section of the network traffic came/went, and I can split the load up onto another CPU on our Snort device as well for faster and more reliable processing.
-rich
0
 
LVL 1

Author Comment

by:WERAracer
Comment Utility
thanks
0

Featured Post

How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

Join & Write a Comment

If you're not part of the solution, you're part of the problem.   Tips on how to secure IoT devices, even the dumbest ones, so they can't be used as part of a DDoS botnet.  Use PRTG Network Monitor as one of the building blocks, to detect unusual…
It’s a strangely common occurrence that when you send someone their login details for a system, they can’t get in. This article will help you understand why it happens, and what you can do about it.
Sending a Secure fax is easy with eFax Corporate (http://www.enterprise.efax.com). First, Just open a new email message.  In the To field, type your recipient's fax number @efaxsend.com. You can even send a secure international fax — just include t…
Polish reports in Access so they look terrific. Take yourself to another level. Equations, Back Color, Alternate Back Color. Write easy VBA Code. Tighten space to use less pages. Launch report from a menu, considering criteria only when it is filled…

763 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

10 Experts available now in Live!

Get 1:1 Help Now