[Snort-users] Snorting MS PPTP VPN
mkettler at ...4108...
Fri Sep 17 12:49:04 EDT 2004
At 01:33 PM 9/17/2004, Lyndon Tiu wrote:
>Is it possible to snort what goes through a MS PPTP VPN? I suspect viruses
>are going through the VPN from one office site to another but can snort
Snort won't be able to decode what's inside your VPN.. If it could, your
VPN would be pointless... Remember, the point of a VPN is to prevent people
from knowing what's going through it.
Now, you could insert a snort sensor some place behind your firewall to see
all the traffic after it's been decrypted.. Couple that with some rules
from bleedingsnort and you could detect this kind of thing, but you're
going to have to snort it before it enters the VPN tunnel.
More information about the Snort-users