Security Basics mailing list archives
Re: Snort and ADSL
From: Adam Botsford <adam () prodigytech com>
Date: Sun, 26 Mar 2006 23:28:23 -0800
Mike, What you need in order for this to work is a separate DSL Modem. It seems that your DSL modem is built into your firewall, thus not allowing you to separate it as you need. Although not the best answer, I do believe it is the most honest one (Unless someone else disagrees). This is not anything horrible though, you can pick up DSL modems in many retail stores or online. The modem will convert the RJ11 to RJ45 and from there you can to into your snort box (A Computer), and from the Snort box to your firewall. For someone who doesn't do this everyday, I would suggest giving yourself plenty of time to do in case of mistakes in configuration. I would also plan out your topology before moving or buying anything. I hope this helps, let me know if you run into any other troubles. Adam Botsford Adam () ProdigyTech com www.ProdigyTech.com www.BashLine.com On Sat, 25 Mar 2006 10:42:08 +0800 "Mike Gilligan" <mikewgilligan () hotmail com> wrote:
thanks for the advice on using the Ethernet Tap. Yes I did consider the tap but remember my Netscreen FW has an integrated ADSL port so these are not two separate devices that I can put a TAP between. The telephone cable plugs directly from the wall into my Netscreen ADSL Firewall and therein lies the problem. Unless there is some way to plug an RJ11 cable into an ethernet tap which I haven't seen done before. Mike.From: James Fryman <jfryman () gmail com> To: Mike Gilligan <mikewgilligan () hotmail com> CC: security-basics () securityfocus com Subject: Re: Snort and ADSL Date: Fri, 24 Mar 2006 15:36:26 -0500 Mike, Two options. 1) Get yourself a passive ethernet tap. These can be made cheaply or bought for some $$. Keep in mind, good taps are not cheap. 2) Grab a cheap dummy hub, and stick it inbetween your Netscreen and your DSL modem. Stick your snort box in promiscuous mode, and snort away! I would create yourself a listening Cat5 cable on Internet NIC segment to prevent any outgoing traffic on your listening port back to the Internet. Some good documents exist on the Snort website to get you started: http://www.snort.org/docs/#deploy Good luck. -James Mike Gilligan wrote:Hi list. I have a Netscreen 5GT ADSL FW at my home with two interfaces - inside and outside. I do have a basic set of IDS sigs on the Netscreen but I would like to set up a Snort sensor outside the Firewall to look at unblocked alerts. However, I only have an RJ11 telephone cable to my ADSL port on the Netscreen and no where to plug in a Snort sensor. I could plug it in on the inside but I miss a lot of the traffic already dropped. I know that some SOHO Firewalls like the Linksys ones let you run Snort on the box itself but this isn't an option for me. Could anyone suggest a feasible solution? thanks. _________________________________________________________________ Get an advanced look at the new version of MSN Messenger. http://messenger.msn.com.sg/Beta/Default.aspx---------------------------------------------------------------------------EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE The Norwich University program offers unparalleled Infosec management education and the case study affords you unmatched consulting experience. Tailor your education to your own professional goals with degree customizations including Emergency Management, Business Continuity Planning, Computer Emergency Response Teams, and Digital Investigations. http://www.msia.norwich.edu/secfocus----------------------------------------------------------------------------- ------------------------- James Fryman email : jfryman () gmail com Cell : 757.812.3126 GnuPG : 0xDAE2C750 "Users are encouraged to engage in the application of a Nerf Bat, or a more sophisticated LART, if needed, to correct the behavioral vector of this attack. " - Bill Nash / Bugtraq Mailing List Preventing PHP Session Hijacking within a Home LAN Segment_________________________________________________________________ Keep track of Singapore & Malaysia stock prices. http://www.msn.com.sg/money/ --------------------------------------------------------------------------- EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE The Norwich University program offers unparalleled Infosec management education and the case study affords you unmatched consulting experience. Tailor your education to your own professional goals with degree customizations including Emergency Management, Business Continuity Planning, Computer Emergency Response Teams, and Digital Investigations. http://www.msia.norwich.edu/secfocus ---------------------------------------------------------------------------
--------------------------------------------------------------------------- EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE The Norwich University program offers unparalleled Infosec management education and the case study affords you unmatched consulting experience. Tailor your education to your own professional goals with degree customizations including Emergency Management, Business Continuity Planning, Computer Emergency Response Teams, and Digital Investigations. http://www.msia.norwich.edu/secfocus ---------------------------------------------------------------------------
Current thread:
- Snort and ADSL Mike Gilligan (Mar 24)
- Re: Snort and ADSL James Fryman (Mar 27)
- Re: Snort and ADSL Mike Gilligan (Mar 27)
- Re: Snort and ADSL Adam Botsford (Mar 28)
- Re: Snort and ADSL Mike Gilligan (Mar 27)
- Re: Snort and ADSL Gaddis, Jeremy L. (Mar 27)
- Re: Snort and ADSL Paul Johnson (Mar 28)
- Re: Snort and ADSL NiTRo (Mar 29)
- Re: Snort and ADSL Paul Johnson (Mar 28)
- Re: Snort and ADSL James Fryman (Mar 27)