[Snort-users] snort behind firewall

Davis, Scott Scott_Davis at ...1915...
Thu Apr 26 11:39:24 EDT 2001


Has anyone had experience running snort on a Checkpoint Firewall ?  I am
running Checkpoint 4.1 on Solaris 2.6 and considering running snort behind
the firewall because I do not want the additional load on the firewall. 

Thanks, 
Scott Davis
Internet Security Specialist
T.Rowe Price 
(410) 345-3153 Work

-----Original Message-----
From: Searle, Robert (XRCC) [mailto:Robert.Searle at ...1910...]
Sent: Thursday, April 26, 2001 9:39 AM
To: snort-users at lists.sourceforge.net
Subject: RE: [Snort-users] snort behind firewall


Is there a way to see but separate both it two separate log files?  What is
the best way of viewing these files?

-----Original Message-----
From: Piers Williams [mailto:PiersW at ...1865...]
Sent: Thursday, April 26, 2001 7:24 AM
To: snort-users at lists.sourceforge.net
Subject: RE: [Snort-users] snort behind firewall


Of course if snort is on the firewall then in fact you get the choice:
monitoring attacks or intrusion (sucessfull attacks), based on which NIC you
monitor (internal vs external)...

-----Original Message-----
From: chj at ...1888... [mailto:chj at ...1888...]
Sent: 26 April 2001 10:04
To: snort-users at lists.sourceforge.net
Subject: RE: [Snort-users] snort behind firewall



If the snort sensor is behind the firewall it is intrusion detection and if
the snort sensor is in front of (or on) the firewall it is attack detection
:-) 
(from Stephen Nortcuts book Network Intrusion Detection) 

_______________________________________________
Snort-users mailing list
Snort-users at lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users

_______________________________________________
Snort-users mailing list
Snort-users at lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users




More information about the Snort-users mailing list