[Snort-users] Snort and Firewall on the same box
Paul D. Shaffer
paulshaf at ...741...
Fri May 11 22:36:59 EDT 2001
Sorry to dig up an old thread which I don't recall ever being
satisfactorily resolved, but I've been pondering a good way to run snort and
an FW on the same box and came up with this angle: Your box has three NICs:
eth0, 1, and 2. Snort listens on eth0. Eth1 and 2 form a stealthed,
bridged firewall with say, eth1 on the outside. Eth0 and eth1 are jacked
into the same hub right behind the external router, ISP, whatever. Does
that not pretty much eliminate any doubt about what snort is seeing,
regardless what the firewall is doing? I might give this a try unless
someone can point out something wrong with the idea...
More information about the Snort-users