[Snort-users] Snort not seeing all traffic?
p.jones.ml at ...8985...
Thu Apr 24 06:15:26 EDT 2003
The Hub is a Linksys Etherfast 10/100 Hub. All 3 links are operating at
100...that was a great point and I was hoping that would be it.
I wanted to point out that Snort does come up with some traffic, just not
all...meaning it does not and has not seen attacks/port scans, deliberate or
otherwise, on the firewall and the IP addresses it handles. It does see
traffic/alerts for a server on the switch below it...Not sure where to go
from here...Should I post my snort.eth1.conf file?
From: Matt Kettler [mailto:mkettler at ...4108...]
Sent: Wednesday, April 23, 2003 5:43 PM
To: p.jones.ml at ...8985...; snort-users at lists.sourceforge.net
Subject: Re: [Snort-users] Snort not seeing all traffic?
Is the "hub" a 10/100 dual-speed hub?
what speed is the interface from the hub to router?
what speed is the interface from the hub to the switch?
what speed is the interface from the hub to eth1 on the IDS box?
If all three numbers are not the same, that's your problem. The 10/100
"auto switching" hubs are network-wise equivalent to a pair of hubs
connected by a 2-port switch (also called an ethernet bridge if you want to
get technical about it, and some of these hubs call themselves "auto
bridging" instead of "auto switching")
10mbit hub ----- switch ------- 100 mbit hub
Thus if there's mismatch in speeds (ie: the snort box is the only 100mbit
connection and the other 2 are 10mbit), it won't actually see the traffic
because of the internal switch between the two speeds.
At 03:17 PM 4/23/2003 -0400, Patrick Jones wrote:
>Red Hat 8.0
>Eth1 no address
>Router - Hub - Switch - Firewall - Internal Network
> | |
> | |
> (Eth1) |
More information about the Snort-users