Re: [Snort-users] Any issues with dup packets on snort?

Hi Jason,
It sounds like, rather than running multiple instances of snort in
different places on your network, you're copying data from multiple
locations on the network back to a single snort interface.
There's no real problem with a configuration like this. You'll probably
get duplicate detects, but you'd get that anyway if you were running
multiple snort instances reporting back to a single location.

- Ramon

Jason Haar wrote:

>We have a range of switches being used within our network for port
>monitoring, and a couple have had to be set up in such a way that you
>can end up seeing each packet TWICE on the snort interface. I've been
>told by our network engineers that this has to be the case in order for
>the IDS to see the networks it needs to on one card.
>
>i.e.
>
>src-ip->dst-ip SYN
>dst-ip->src-ip SYN-ACK
>
>actually looks like
>
>src-ip->dst-ip SYN
>src-ip->dst-ip SYN
>dst-ip->src-ip SYN-ACK
>dst-ip->src-ip SYN-ACK
>
>Anyway, I have no problem with that, and snort "seems" to be happy too.
>Can someone confirm that duplicate packets aren't a problem? That
>worst-case should be duplicate alerts?
>
>


-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems? Stop! Download the new AJAX search engine that makes
searching your log files as easy as surfing the web. DOWNLOAD SPLUNK!
http://ads.osdn.com/?ad_id=7637&alloc_id=16865&op=click
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/...fo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.p...st=snort-users