[Snort-users] Listen at location Q, analyze at location X
richard_bejtlich at ...131...
Mon Jun 23 06:12:36 EDT 2003
This message is intended as a response to Everett
Ward's question on how to listen at one location and
analyze traffic at another. Although the original
question mentioned Windows and Linux, an all-Linux
architecture might be able to use the recently
(http://www.cs.tau.ac.il/~nnavi/vtun/). From the
"SVtun is a simple and powerful distributed sniffer
which is based on virtual tunnels. It extends the
basic encryption and compression functionality of vtun
to support a new interface type "sniff" and provides
simple and efficient packet filtering and basic
asymmetric processing for client/server roles. SVtun
is useful for delivering traffic captures from probes
to the central server, so that traffic analysis,
disk-logging and/or intrusion detection can be
I haven't tried it yet.
richard at taosecurity dot com
Do you Yahoo!?
SBC Yahoo! DSL - Now only $29.95 per month!
More information about the Snort-users