Snort mailing list archives
Re: Snorting MS PPTP VPN
From: Matt Kettler <mkettler () evi-inc com>
Date: Fri, 17 Sep 2004 15:47:37 -0400
At 01:33 PM 9/17/2004, Lyndon Tiu wrote:
Is it possible to snort what goes through a MS PPTP VPN? I suspect viruses are going through the VPN from one office site to another but can snort help here?
Snort won't be able to decode what's inside your VPN.. If it could, your VPN would be pointless... Remember, the point of a VPN is to prevent people from knowing what's going through it.
Now, you could insert a snort sensor some place behind your firewall to see all the traffic after it's been decrypted.. Couple that with some rules from bleedingsnort and you could detect this kind of thing, but you're going to have to snort it before it enters the VPN tunnel.
------------------------------------------------------- This SF.Net email is sponsored by: YOU BE THE JUDGE. Be one of 170 Project Admins to receive an Apple iPod Mini FREE for your judgement on who ports your project to Linux PPC the best. Sponsored by IBM. Deadline: Sept. 24. Go here: http://sf.net/ppc_contest.php _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Snorting MS PPTP VPN Lyndon Tiu (Sep 17)
- Re: Snorting MS PPTP VPN Matt Kettler (Sep 17)