[Snort-users] Basics of setting up an inline snort installation

PS packetstack at ...11827...
Thu Feb 9 13:11:20 EST 2012


When I first setup snort inline I only had two interfaces. One being my wan interface (eth0) and the other the LAN interface (eth1). I am able to run inline with just those two interfaces, but it is not recommended. Both are set to promiscuous mode. So it can be done with two if you really need to. Both interfaces have IP addresses.

As for them needing IP addresses, I am not sure how it could be inline without IP addresses. How would traffic be routed?

Again, it's best if you have a third interface for management.


On Feb 9, 2012, at 12:29 PM, Dave Kelly <bigdavekelly at ...14012...> wrote:

> Thanks, that might make a bit more sense!  So the two interfaces that
> are bridging don't need IP addresses?  I haven't seen a guide to
> setting this up anywhere, do you know of one?
> 
> Dave.
> 
> On Thu, Feb 9, 2012 at 4:21 PM, Heine Lysemose <lysemose at ...11827...> wrote:
>> Hi,
>> 
>> To setup Snort as inline you need 3 network interface and pass your traffic
>> through a bridge between 2 of the interfaces and a 3. for administration.
>> You can start Snort with -Q to enable inline.
>> 
>> /Lysemose
>> 
>> On Feb 9, 2012 4:23 PM, "Dave Kelly" <bigdavekelly at ...14012...> wrote:
>>> 
>>> Hello,
>>> 
>>> I'm going to try setting up a new inline configuration, I've only
>>> tried passive before but would like Snort to be able to drop packets
>>> it says are bad.  I'm trying to work out the IP addressing for it. At
>>> the moment, I have all my machines in 192.168.1.0/24 with a router at
>>> 192.168.1.1 and a mirrored port on the switch sending all traffic to
>>> snort.
>>> 
>>> It's pretty similar to the Ubuntu getting started guide in the docs
>>> ("Snort 2.9.2.0 on Ubuntu 10.04 LTS").
>>> 
>>> I think that to move snort to inline I'm going to need to give it a
>>> proper IP address and have the traffic pass through it but I can't
>>> quite work out how to do that without reconfiguring all the hosts to
>>> have new gateway addresses etc.  Any hints to get me going would be
>>> much appreciated.
>>> 
>>> Dave.
>>> 
>>> 
>>> ------------------------------------------------------------------------------
>>> Virtualization & Cloud Management Using Capacity Planning
>>> Cloud computing makes use of virtualization - but cloud computing
>>> also focuses on allowing computing to be delivered as a service.
>>> http://www.accelacomm.com/jaw/sfnl/114/51521223/
>>> _______________________________________________
>>> Snort-users mailing list
>>> Snort-users at lists.sourceforge.net
>>> Go to this URL to change user options or unsubscribe:
>>> https://lists.sourceforge.net/lists/listinfo/snort-users
>>> Snort-users list archive:
>>> http://www.geocrawler.com/redir-sf.php3?list=snort-users
>>> 
>>> Please visit http://blog.snort.org to stay current on all the latest Snort
>>> news!
> 
> ------------------------------------------------------------------------------
> Virtualization & Cloud Management Using Capacity Planning
> Cloud computing makes use of virtualization - but cloud computing 
> also focuses on allowing computing to be delivered as a service.
> http://www.accelacomm.com/jaw/sfnl/114/51521223/
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users
> 
> Please visit http://blog.snort.org to stay current on all the latest Snort news!




More information about the Snort-users mailing list