[Snort-users] Listen at location Q, analyze at location X

Richard Bejtlich richard_bejtlich at ...131...
Mon Jun 23 06:12:36 EDT 2003


This message is intended as a response to Everett
Ward's question on how to listen at one location and
analyze traffic at another.  Although the original
question mentioned Windows and Linux, an all-Linux
architecture might be able to use the recently
announced SVtun
(http://www.cs.tau.ac.il/~nnavi/vtun/).  From the
Packetstorm description:

"SVtun is a simple and powerful distributed sniffer
which is based on virtual tunnels. It extends the
basic encryption and compression functionality of vtun
to support a new interface type "sniff" and provides
simple and efficient packet filtering and basic
asymmetric processing for client/server roles. SVtun
is useful for delivering traffic captures from probes
to the central server, so that traffic analysis,
disk-logging and/or intrusion detection can be
performed there."

I haven't tried it yet.

Good luck,

Richard Bejtlich
richard at taosecurity dot com
http://taosecurity.com


__________________________________
Do you Yahoo!?
SBC Yahoo! DSL - Now only $29.95 per month!
http://sbc.yahoo.com




More information about the Snort-users mailing list