Re: [Snort-users] How to setup inline

Would I still need the Optical Bypass Switch, if I used a dual nic that
will still bridge even if the box is offline? That way it would do
basically the same thing correct? Thats what we have in our caching server.

Mike

Eric Hines wrote:

>-----BEGIN PGP SIGNED MESSAGE-----
>Hash: SHA1
>
>Mike,
>
>Will has a good point here. I wouldn't run all the rulesets if this is
>an ISP and the bandwidth is high. Remember, if Snort-Inline can't keep
>up with the speeds you're at, its GOING to drop packets. We need to know
>a lot more than it just being a WISP :)
>
>Also, if Snort-Inline goes offline for any reason, your network WILL go
>down. When Applied Watch sells its Snort-Inline IPS appliance, we never
>sell it without a Net Optics Optical Bypass Switch. So I'd couple your
>IPS with the Optical Bypass Switch as it has a heartbeat packet that
>passes through the IPS. If it doesn't get the heartbeat packet back, it
>immediately begins redirecting traffic through the bypass switch to keep
>the network up and running.
>
>FYI:
>http://www.netoptics.com/products/pr...em=8&filter=30
>
>They have them for both Gigabit fiber, copper, and 10/100.
>
>
>Best Regards,
>
>Eric Hines, GCIA, CISSP
>CEO, President
>Applied Watch Technologies, LLC
>
>
>- ---------------------------------------------
>
>Eric Hines, GCIA, CISSP
>CEO, President
>Applied Watch Technologies, LLC
>1095 Pingree Road
>Suite 213
>Crystal Lake, IL 60014
>Toll Free: (877) 262-7593 ext:327
>Direct: (847) 854-2725 ext:327
>Fax: (847) 854-5106
>Web: http://www.appliedwatch.com
>Email: eric.hines@appliedwatch.com
>
>- --------------------------------------------
>
>"Enterprise Open Source Security Management"
>
>
>Will Metcalf wrote:
>
>
>>On 4/9/06, Mike Montgomery <mmontgomery@c3bb.com> wrote:
>>
>>
>>>What would the hardware requirements be on a system to run inline for
>>>snort?
>>>Will be using it at the headend of a WISP, with currently approx
>>>850 customers. I have a AMD Sempron +1800 with 1gb ram and 2 80gb hdds
>>>setup in Raid0.
>>>Will that be sufficient to handle the load?
>>>
>>>
>>Errr this is a relative question.... Are you going to allow the use of
>>highly interactive protocols? What are you going to be doing
>>reassembly on? How much of the traffic you are performing reassembly
>>on makes up the total amount of traffic. What rulesets will be
>>enabled? More importantly what is the size of the connection you are
>>going to be running snort through? If you are just guarding a
>>T1,DSL,or a small ATM connection or something this should be fine, but
>>you won't know until you try it ;-)
>>
>>Regards,
>>
>>Will
>>
>>
>>>Mike
>>>
>>>Eric Hines wrote:
>>>
>>>
>>>
>>Mike,
>>
>>Answer 1) Yes, you will want (3) NICs on your box. Pop a new NIC in
>>there. When you bridge it, you will have br0 for example, which will
>>comprise a bridge of eth1 and eth2. Make eth0 your management interface
>>and give it an IP.
>>
>>eth0: 192.168.0.1
>>eth1: 0.0.0.0
>>eth2. 0.0.0.0
>>
>>Answer 2) Snort-Inline uses netfilter, ipqueue, etc for dropping
>>packets. Their are numerous writeups on how to set this up.
>>
>>Answer 3) Specifying which attacks are dropped is done using the drop,
>>sdrop, etc. keywords in the action of the individual signature.
>>
>>
>>I hope this helps.
>>
>>
>>
>>Best Regards,
>>
>>Eric Hines, GCIA, CISSP
>>CEO, President
>>Applied Watch Technologies, LLC
>>
>>
>>---------------------------------------------
>>
>>Eric Hines, GCIA, CISSP
>>CEO, President
>>Applied Watch Technologies, LLC
>>1095 Pingree Road
>>Suite 213
>>Crystal Lake, IL 60014
>>Toll Free: (877) 262-7593 ext:327
>>Direct: (847) 854-2725 ext:327
>>Fax: (847) 854-5106
>>Web: http://www.appliedwatch.com
>>Email: eric.hines@appliedwatch.com
>>
>>--------------------------------------------
>>
>>"Enterprise Open Source Security Management"
>>
>>
>>Mike Montgomery wrote:
>>
>>
>>
>>
>>>>>>Hello,
>>>>>>
>>>>>>I recently setup a box running snort at our headend, its not inline as
>>>>>>of now, but its using a monitor port on a cisco 2950. What would be the
>>>>>>ideal setup to put the box inline? I currently have 2 nics in this box,
>>>>>>1 on the monitor port, 2nd is the nic I use to connect to the box for
>>>>>>console. To go inline, would I need 3 nics total, 1 in, 1 out, and set
>>>>>>them to be bridged? Or what. If I wanted snort to drop the packets for
>>>>>>say P2P, would snort do that by itself, or would I need to have a
>>>>>>firewall running to do that. Just trying to make some sense of this.
>>>>>>
>>>>>>Thanks
>>>>>>
>>>>>>Mike Montgomery
>>>>>>Citizens Communications Corp.
>>>>>>/Systems Administrator/
>>>>>>
>>>>>>
>>>>>>-------------------------------------------------------
>>>>>>This SF.Net email is sponsored by xPML, a groundbreaking scripting language
>>>>>>that extends applications into web and mobile media. Attend the live
>>>>>>webcast
>>>>>>and join the prime developer group breaking into this new coding territory!
>>>>>>http://sel.as-us.falkag.net/sel?cmd=...720&dat=121642
>>>>>>____________________________________________ ___
>>>>>>Snort-users mailing list
>>>>>>Snort-users@lists.sourceforge.net
>>>>>>Go to this URL to change user options or unsubscribe:
>>>>>>https://lists.sourceforge.net/lists/...fo/snort-users
>>>>>>Snort-users list archive:
>>>>>>http://www.geocrawler.com/redir-sf.p...st=snort-users
>>>>>>
>>>>>>
>>>>>>
>>>>>>
>>>>
>>>>
>>>>
>>>>
>>>-------------------------------------------------------
>>>This SF.Net email is sponsored by xPML, a groundbreaking scripting language
>>>that extends applications into web and mobile media. Attend the live webcast
>>>and join the prime developer group breaking into this new coding territory!
>>>http://sel.as-us.falkag.net/sel?cmd=...720&dat=121642
>>>_____________________________________________ __
>>>Snort-users mailing list
>>>Snort-users@lists.sourceforge.net
>>>Go to this URL to change user options or unsubscribe:
>>>https://lists.sourceforge.net/lists/...fo/snort-users
>>>Snort-users list archive:
>>>http://www.geocrawler.com/redir-sf.p...st=snort-users
>>>
>>>
>>>
>
>
>
>>-------------------------------------------------------
>>This SF.Net email is sponsored by xPML, a groundbreaking scripting language
>>that extends applications into web and mobile media. Attend the live webcast
>>and join the prime developer group breaking into this new coding territory!
>>http://sel.as-us.falkag.net/sel?cmd=k&kid0944&bid$1720&dat1642
>>______________________________________________ _
>>Snort-users mailing list
>>Snort-users@lists.sourceforge.net
>>Go to this URL to change user options or unsubscribe:
>>https://lists.sourceforge.net/lists/...fo/snort-users
>>Snort-users list archive:
>>http://www.geocrawler.com/redir-sf.php3?list=ort-users
>>
>>
>-----BEGIN PGP SIGNATURE-----
>Version: GnuPG v1.4.2 (GNU/Linux)
>Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
>
>iD8DBQFEOat1bOqF2QHgUK0RAltuAJ44HNffqlO88cpg+khnc yAiAo9bRQCaAitJ
>MAJ+EahXI/kktJzn5srOJrY=
>=Fcf7
>-----END PGP SIGNATURE-----
>
>
>-------------------------------------------------------
>This SF.Net email is sponsored by xPML, a groundbreaking scripting language
>that extends applications into web and mobile media. Attend the live webcast
>and join the prime developer group breaking into this new coding territory!
>http://sel.as-us.falkag.net/sel?cmd=...720&dat=121642
>_______________________________________________
>Snort-users mailing list
>Snort-users@lists.sourceforge.net
>Go to this URL to change user options or unsubscribe:
>https://lists.sourceforge.net/lists/...fo/snort-users
>Snort-users list archive:
>http://www.geocrawler.com/redir-sf.p...st=snort-users
>
>
>
>



-------------------------------------------------------
This SF.Net email is sponsored by xPML, a groundbreaking scripting language
that extends applications into web and mobile media. Attend the live webcast
and join the prime developer group breaking into this new coding territory!
http://sel.as-us.falkag.net/sel?cmd=...720&dat=121642
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/...fo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.p...st=snort-users