[Snort-users] Snorting MS PPTP VPN

Matt Kettler mkettler at ...4108...
Fri Sep 17 12:49:04 EDT 2004

At 01:33 PM 9/17/2004, Lyndon Tiu wrote:
>Is it possible to snort what goes through a MS PPTP VPN? I suspect viruses 
>are going through the VPN from one office site to another but can snort 
>help here?

Snort won't be able to decode what's inside your VPN.. If it could, your 
VPN would be pointless... Remember, the point of a VPN is to prevent people 
from knowing what's going through it.

Now, you could insert a snort sensor some place behind your firewall to see 
all the traffic after it's been decrypted.. Couple that with some rules 
from bleedingsnort and you could detect this kind of thing, but you're 
going to have to snort it before it enters the VPN tunnel.

More information about the Snort-users mailing list