[Snort-users] Stealth interface

Willy, Andrew AWilly at ...13017...
Tue Feb 15 12:15:28 EST 2005


Does an interface without an IP address qualify as a stealth interface or is
there more to it?
 
Andrew

-----Original Message-----
From: Bob Konigsberg [mailto:bobkberg at ...12746...]
Sent: Tuesday, February 15, 2005 12:59 PM
To: snort-users at lists.sourceforge.net
Subject: RE: [Snort-users] Stealth interface


The basic purpose of the stealth interface is to prevent an attacker from
knowing that you've got a monitoring box present.
 
Typically, you'd have two or more interfaces, and the one you "talk" to with
an IP address would not even be on the same network as the stealth
interface.
 
Bob

   _____  

From: snort-users-admin at lists.sourceforge.net
[mailto:snort-users-admin at lists.sourceforge.net] On Behalf Of Willy, Andrew
Sent: Tuesday, February 15, 2005 11:56 AM
To: snort-users at lists.sourceforge.net
Subject: [Snort-users] Stealth interface


Hello,
 
Would any of you mind explaining the need for, the setup, and the
application of a stealth interface on an IDS box?  I'm new to Snort and ID
as a whole.  Google returned interesting but seemingly incomplete
information on the subject.
 
Thanks
 
Andrew
 
 

NOTICE OF CONFIDENTIALITY-The information in this email, including
attachments, may be confidential and/or privileged and may contain
confidential health information. This email is intended to be reviewed only
by the individual or organization named as addressee. If you have received
this email in error please notify Scottsdale Medical Imaging, an affiliate
of Southwest Diagnostic Imaging, LTD immediately - by return message to the
sender or to support at ...13018... - and destroy all copies of this message and
any attachments. Please note that any views or opinions presented in this
email are solely those of the author and do not necessarily represent those
of Scottsdale Medical Imaging. Confidential health information is protected
by state and federal law, including, but not limited to, the Health
Insurance Portability and Accountability Act of 1996 and related
regulations.

NOTICE OF CONFIDENTIALITY-The information in this email, including
attachments, may be confidential and/or privileged and may contain
confidential health information. This email is intended to be reviewed only
by the individual or organization named as addressee. If you have received
this email in error please notify Scottsdale Medical Imaging, an affiliate
of Southwest Diagnostic Imaging, LTD immediately - by return message to the
sender or to support at ...13018... - and destroy all copies of this message and
any attachments. Please note that any views or opinions presented in this
email are solely those of the author and do not necessarily represent those
of Scottsdale Medical Imaging. Confidential health information is protected
by state and federal law, including, but not limited to, the Health
Insurance Portability and Accountability Act of 1996 and related
regulations.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20050215/4b3c4407/attachment.html>


More information about the Snort-users mailing list