[Snort-users] More explanation needed in Snort User Manual for "resp:"?
Kristofer T. Karas
ktk at ...10113...
Thu Nov 6 14:00:04 EST 2003
Jason Haar wrote:
>I've looked at flexresp2, and it allows you to explicitly configure which
>interface RESET packets are set through - which is almost there. But this
>still seems like a bug to me, as I can't think of a reason why you would
>ever want the packet to leave through anything other than the interface it
>was seen on!
Because most interfaces used to receive promiscuously-captured packets
are set up for passive monitoring: they often span multiple VLANs or
trunks; injecting packets along the same path would result in a
one-to-many problem on the receiving end. For this very reason, most
network admins I've talked with literally cut the transmit pair on the
network cable to prevent this. For those using a Cisco setup, spanning
VLANs to a monitor port makes that port transmit-only. For those that
consolidate multiple monitor ports into a single feed to Snort (by way
of using a dedicated switch) will have an exacerbated problem when
trying to send data back along the consolidated feed.
For these reasons (and the TAP mentioned) I am very grateful that Snort
sends flexresp packets via the OS's routing table. After all, you
can always add a route to send them out the promiscuous interface if
that's what strikes your fancy.
To deal with the NAT issues, just place your promiscuous feed inbound
from your NAT box, e.g. in your DMZ. Snort will only see your inside IP
addresses, which is, after all, what you really want anyway; there's no
point in reporting issues with a shared IP address, as you can't (in
general) track that back to a specific post-NAT machine.
More information about the Snort-users