Printable View
I was thinking on setting up snort on one of my boxes, but I have a question since in a switch lan I'll be only capturing data in and out of my box only, what's the right way of setting up snort so it captures data in and out of my three servers, without having to put a hub in the middle.........
thanks in advance.
It depends on the switch you are using, if it's a managed switch look into port spanning/mirroring
Most dont support that unless they are really high end. You can always use ARP Cache poisioning.
when I usually want to capture data from a computer in my network that's what I do....but I dont want to leave it running for too long, I may DOS my target machine, because the machine doing the routing or (MITM ATTACK) is just a desktop and not capable of handling big amounts of data.........correct me if I'm wrongQuote:
Originally Posted by oofki
thanks
The Wolfman doesn't know if this will suit your cool cat requirements, but perhaps putting a network tap in your DMZ to capture all traffic coming in and out your network?
For example:
Internet
|
TAP/Snort
|
Router
|
Server 1 Server 2 Server 3
If your goal is to see traffic in/out of your network, you can use some proxy/vpn/firewall/ids all in one like IPCOP. It has snort built right into it and it runs on pretty low hardware. http://ipcop.org Keep in mind, if you do it this way, you're only going to be inspecting traffic to/from the internet. Not ALL traffic on the LAN.
If you want to capture traffic on your LAN, you'll have to use either the HUB or a port spanning switch. Either way, either physically or logically, you have to put some device between them to capture the traffic betwen them. It's just the rules of networking. Arp spoofing would work for lower end switches, but the higher end swiches have protection against this. I would not use this approach long term or in production for the reason you've already mentioned.
Be careful which IDS you use and how much resources you have to spare. I just built a snort 2.7.0.1 box to monitor a 100MB connection with Dual Core AMD 64bit processors, 2gigs of DDR2 PC5300 (667mhz) RAM, Hardened (high secure worksation security policy, disabled all unused services, hardened whatever left over services I could) XP Pro 64bit 2003, mysql, IIS6 (w/SSL).
Snort is using 1.6gigs of memory when starting up and levels off to around 1.5gigs. The commit charge of the box is around 2gigs... so I'm using almost ALL physical memory available and falling back on the pagefile. Not ideal for an IDS... especially since I only have one 7200RPM SATAII HD in there for OS, pagefile, programs, sql database and IIS. I should have two HDs or even three. I'll have to bump the memory even more and look at into getting a second HD to increase read/write performance of the database and IIS. :( However, at this time... it's not dropping packets and it's in a testing environment.
I just finally moved away from the 2.4.x line. The 2.4.x line didn't use nearly as much memory...
Taps are the way to go, if you can afford em.
I've also tried dumb things like using a box as a router and snort on that box, created a bridge from a linux box and run snort on it.
Hub are cheap and easy, but Taps are great if your budget will allow it.
Port mirroring is nice, some switch will actually dump off pcap info that you can run thru snort as well. I don't have access to a Catalyst to check on it, but Nortel Passports have the option for sure.
Cisco switches (CatOS and IOS) have this option too. It's called a SPAN (Switched Port ANalyzer) port.
http://www.cisco.com/warp/public/473/41.html