[Snort-users] Is this config. ok

Kenny D bitored2002 at ...3162...
Wed Feb 20 09:03:04 EST 2002


Hi,

I have setup snort and it is very quiet. I just want
to make sure everything i done is correct. I have set
it up as follows

internet -- router --- (public ip
outside)pix(inside172.16.1.1) --- (172.16.1.2)
3005Concentrator (172.17.1.1) --- my inside network on
172.17.1.0

My snort machine is monitoring all traffic coming from
the pix inside interface, i am using span port
mirroring on my switch. When i turn on alert tcp any
any -> any any i do see plenty of traffic going back
and forward. However when i turn it off it is very
quiet. I assume my router and firewall is doing a good
job but how can i be sure it all works. An external
scan didnt create any alerts. I set my home network in
snort to 172.17.1.0

Can anyone help me here?

Thanks. 

http://movies.yahoo.com.au - Yahoo! Movies
- Vote for your nominees in our online Oscars pool.




More information about the Snort-users mailing list