Subject: Re: Sniffing split connections - msg#00035

Previous Message by Date: click to view message preview

Re: Sniffing split connections

You could try using a Symantec ManHunt or SNS unit; they can cross-correlate between interfaces. YMMV, but it has worked for me before. Try an eval SNS box and see how it works for you. -------------------------------------------------- J o h a n n v a n D u y n -------------------------------------------------- "The most common of all follies is to believe passionately in the palpably not true. It is the chief occupation of mankind." --H. L. Mencken _____________________________________________________________________ Confidentiality Notice: The information in this document and attachments is confidential and may also be legally privileged. It is intended only for the use of the named recipient. Internet communications are not secure and therefore British American Tobacco does not accept legal responsibility for the contents of this message. If you are not the intended recipient, please notify us immediately and then delete this document. Do not disclose the contents of this document to any other person, nor take any copies. Violation of this notice may be unlawful. ______________________________________________________________________ -------------------------------------------------------------------------- Stop hurting your network! The NeVO passive vulnerability sensor continuously finds vulnerabilities, applications and new hosts without the need for network scanning. It also finds compromised systems with application-based intrusion detection. Go to http://www.tenablesecurity.com/products/nevo.shtml to learn more. --------------------------------------------------------------------------

Next Message by Date: click to view message preview

Re: Sniffing split connections

Another option: FreeBSD supports interface bridging, you could have two interfaces on a single FreeBSD machine and bridge them both together to have a unified place to sniff from. -Barrett On Apr 13, 2005, at 2:45 PM, Geff Ambrose wrote: Chris A question for you, the handoff from the ATM switch is it Ethernet or ATM? If it is Ethernet you should check out a company called Top Layer networks, they have a product called the IDS Balancer that plays well in asymmetric environments and will reassemble the traffic flows for you. your snort boxes will see both sides of the traffic and you can then load balance to a bunch of sensors www.toplayer.com Geff -----Original Message----- From: Chris Mills [mailto:securinate@xxxxxxxxx] Sent: Monday, April 11, 2005 12:37 PM To: focus-ids@xxxxxxxxxxxxxxxxx Subject: Sniffing split connections Hi all- Here's the problem I'm having: I have a client site that has two physical connections from its ATM switch that connect to two different providers. The ATM switch uses both connections all the time (not set up as a failover.) The ATM switch at the site will not let me mirror the ports so I can't sniff there... and after the two providers, the connection is too fast for my equipment. I am using Snort 2.3.2 on PowerEdge 1750's. If I place a sniffer at both provider A and provider B, is there a way I can reassemble the traffic so I can see complete sessions? The two providers are on different sides of town. |--------|PROVIDER A|\ Client Site| |-----------|INTERNET| |--------|PROVIDER B|/ Thanks very much, Chris ----------------------------------------------------------------------- --- Stop hurting your network! The NeVO passive vulnerability sensor continuously finds vulnerabilities, applications and new hosts without the need for network scanning. It also finds compromised systems with application-based intrusion detection. Go to http://www.tenablesecurity.com/products/nevo.shtml to learn more. ----------------------------------------------------------------------- --- ----------------------------------------------------------------------- --- Stop hurting your network! The NeVO passive vulnerability sensor continuously finds vulnerabilities, applications and new hosts without the need for network scanning. It also finds compromised systems with application-based intrusion detection. Go to http://www.tenablesecurity.com/products/nevo.shtml to learn more. ----------------------------------------------------------------------- --- -------------------------------------------------------------------------- Stop hurting your network! The NeVO passive vulnerability sensor continuously finds vulnerabilities, applications and new hosts without the need for network scanning. It also finds compromised systems with application-based intrusion detection. Go to http://www.tenablesecurity.com/products/nevo.shtml to learn more. --------------------------------------------------------------------------

Previous Message by Thread: click to view message preview

Re: Sniffing split connections

That would work if I could have both connections to one sensor. I have one sensor in each of two buildings, so bonding won't work. Thanks though... Chris On 4/14/05, rusty chiles <rustychiles@xxxxxxxxx> wrote: > You could always use the linux kernels bonding feature. > > It will take 2 ethernet interfaces and trunk the traffic flowing > through them into a virtual interface that you can tell snort to > listen on. > > Example > > All traffic from eth1 and eth2 will be combined to a virtual interface > device called bond0. > > To set this up you would do something similar to this: > #load the bonding kernel module > modprobe bonding > #bring up your interfaces that can see the traffic in promiscous mode > ifconfig eth1 promisc -arp up > ifconfig eth2 promisc -arp up > #bring up the bonding interface > ifconfig bond0 promisc -arp up > #enslave eth1 and eth2 to the bond0 interface > ifenslave bond0 eth1 > ifenslave bond0 eth2 > > Now instead of telling snort to run on eth1 or eth2 etc you will need > to tell it to run on bond0. > > If all works you should see all traffic from eth1 and eth2 on bond0. > > Hope this helps. > > -Rusty > > On 4/11/05, Chris Mills <securinate@xxxxxxxxx> wrote: > > Hi all- > > > > Here's the problem I'm having: > > > > I have a client site that has two physical connections from its ATM > > switch that connect to two different providers. The ATM switch uses > > both connections all the time (not set up as a failover.) The ATM > > switch at the site will not let me mirror the ports so I can't sniff > > there... and after the two providers, the connection is too fast for > > my equipment. I am using Snort 2.3.2 on PowerEdge 1750's. If I place a > > sniffer at both provider A and provider B, is there a way I can > > reassemble the traffic so I can see complete sessions? The two > > providers are on different sides of town. > > > > |--------|PROVIDER A|\ > > Client Site| |-----------|INTERNET| > > |--------|PROVIDER B|/ > > > > Thanks very much, > > > > Chris > > > > -------------------------------------------------------------------------- > > Stop hurting your network! > > > > The NeVO passive vulnerability sensor continuously finds vulnerabilities, > > applications and new hosts without the need for network scanning. > > It also finds compromised systems with application-based intrusion > > detection. > > Go to http://www.tenablesecurity.com/products/nevo.shtml to learn more. > > -------------------------------------------------------------------------- > > > > > -------------------------------------------------------------------------- Stop hurting your network! The NeVO passive vulnerability sensor continuously finds vulnerabilities, applications and new hosts without the need for network scanning. It also finds compromised systems with application-based intrusion detection. Go to http://www.tenablesecurity.com/products/nevo.shtml to learn more. --------------------------------------------------------------------------

Next Message by Thread: click to view message preview

RE: Sniffing split connections

Chris A question for you, the handoff from the ATM switch is it Ethernet or ATM? If it is Ethernet you should check out a company called Top Layer networks, they have a product called the IDS Balancer that plays well in asymmetric environments and will reassemble the traffic flows for you. your snort boxes will see both sides of the traffic and you can then load balance to a bunch of sensors www.toplayer.com Geff -----Original Message----- From: Chris Mills [mailto:securinate@xxxxxxxxx] Sent: Monday, April 11, 2005 12:37 PM To: focus-ids@xxxxxxxxxxxxxxxxx Subject: Sniffing split connections Hi all- Here's the problem I'm having: I have a client site that has two physical connections from its ATM switch that connect to two different providers. The ATM switch uses both connections all the time (not set up as a failover.) The ATM switch at the site will not let me mirror the ports so I can't sniff there... and after the two providers, the connection is too fast for my equipment. I am using Snort 2.3.2 on PowerEdge 1750's. If I place a sniffer at both provider A and provider B, is there a way I can reassemble the traffic so I can see complete sessions? The two providers are on different sides of town. |--------|PROVIDER A|\ Client Site| |-----------|INTERNET| |--------|PROVIDER B|/ Thanks very much, Chris -------------------------------------------------------------------------- Stop hurting your network! The NeVO passive vulnerability sensor continuously finds vulnerabilities, applications and new hosts without the need for network scanning. It also finds compromised systems with application-based intrusion detection. Go to http://www.tenablesecurity.com/products/nevo.shtml to learn more. -------------------------------------------------------------------------- -------------------------------------------------------------------------- Stop hurting your network! The NeVO passive vulnerability sensor continuously finds vulnerabilities, applications and new hosts without the need for network scanning. It also finds compromised systems with application-based intrusion detection. Go to http://www.tenablesecurity.com/products/nevo.shtml to learn more. --------------------------------------------------------------------------