Re: Listening to all devices

By that, I assume you’re referring to port mirroring. It is not something I’ve tried myself, but articles I’ve found no the internet suggests it’s doable.

This does mean that you’d need (preferably) two virtual interfaces on your VMs; one for working with the VM, and the other to receive mirrored traffic.

I haven’t reviewed the following articles in details as it’s 11.37 PM Friday here in Melbourne (Australia), but I believe it’ll give you a clear idea on how this could be implemented in your environment.

Setting up Snort - Part 1 - Overview · Don Mizutani<http://donmizutani.com/pages/snort/setup/1-overview/>

From: Paul Giovanni <[email protected]>
Sent: Friday, March 1, 2024 11:03 PM
To: Andrian Andrian <[email protected]>; [email protected]
Subject: Re: Listening to all devices

You don't often get email from [email protected]<mailto:[email protected]>. Learn why this is important<https://aka.ms/LearnAboutSenderIdentification>
Is there any chance I can just mirror the traffic to my VM? We have a decent firewall

Get Outlook for Android<https://aka.ms/AAb9ysg>
Paul Giovanni​​​​
IT Project Manager
Edison, NJ<https://goo.gl/alXFy5> P: <tel:7329855000> (732) 985-5000<tel:7329855000>
Gloucester City, NJ<https://goo.gl/PgMNnW> P: (856) 212-0050<tel:8562120050>
[Facebook]<https://www.facebook.com/RaritanGroup/>
[Instagram]<https://www.instagram.com/raritangroup/>
[LinkedIn]<https://www.linkedin.com/company/raritan-group>
[cid:[email protected]]<http://www.raritangroup.com/>


________________________________
From: Andrian Andrian <[email protected]<mailto:[email protected]>>
Sent: Friday, March 1, 2024 6:50:34 AM
To: Paul Giovanni <[email protected]<mailto:[email protected]>>; [email protected]<mailto:[email protected]> <[email protected]<mailto:[email protected]>>
Subject: RE: Listening to all devices

You don't often get email from [email protected]<mailto:[email protected]>. Learn why this is important<https://aka.ms/LearnAboutSenderIdentification>

Hi Paul,



I believe that is how Snort works, unless it is installed on your router/gateway/firewall and configured to monitor traffic on your LAN port, in which case it would be able to monitor traffic between your internal endpoints and the gateway.



From: Snort-users <[email protected]<mailto:[email protected]>> On Behalf Of Paul Giovanni
Sent: Thursday, February 29, 2024 12:26 AM
To: [email protected]<mailto:[email protected]>
Subject: [Snort-users] Listening to all devices



You don't often get email from [email protected]<mailto:[email protected]>. Learn why this is important<https://urldefense.proofpoint.com/v2/url?u=https-3A__aka.ms_LearnAboutSenderIdentification&d=DwMGaQ&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=h7KmwhwQTf-8idLOkUGqw_U9le4wAdZNjMPKN0d78EY&m=4OZSCmiNx6Z07N5dsJ74H30geLOwnkB7ayE-SDu4vuqk5Ign75FgFg0d93Uge6Ev&s=UgApfkA9Wa9_KSZrPYnqLcMvte-PUJjwAoA55ED5UW4&e=>

Hello Snort community,



I am trying to get snort to detect all network packets on all network devices, but right now it seems to only be listening on the device I have it installed on. Is there something I’m missing? My config has



-- HOME_NET and EXTERNAL_NET must be set now

23 -- setup the network addresses you are protecting

24 HOME_NET = '10.0.0.0/24'



All I’m seeing are broadcast messages.



Thanks,



Paul Giovanni​​​​

IT Project Manager

Edison, NJ<https://urldefense.proofpoint.com/v2/url?u=https-3A__goo.gl_alXFy5&d=DwMGaQ&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=h7KmwhwQTf-8idLOkUGqw_U9le4wAdZNjMPKN0d78EY&m=4OZSCmiNx6Z07N5dsJ74H30geLOwnkB7ayE-SDu4vuqk5Ign75FgFg0d93Uge6Ev&s=0MsV-Zu8ur2kHqcumb40zUMzFbjD-0eFqbYPPuA0Fv8&e=> P: <tel:7329855000> (732) 985-5000<tel:7329855000>

Gloucester City, NJ<https://urldefense.proofpoint.com/v2/url?u=https-3A__goo.gl_PgMNnW&d=DwMGaQ&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=h7KmwhwQTf-8idLOkUGqw_U9le4wAdZNjMPKN0d78EY&m=4OZSCmiNx6Z07N5dsJ74H30geLOwnkB7ayE-SDu4vuqk5Ign75FgFg0d93Uge6Ev&s=yOjVvSEOuX7pip66dYnNj4mU8932t6GWXeKPbBTzCDs&e=> P: (856) 212-0050<tel:8562120050>

[cid:[email protected]]<https://urldefense.proofpoint.com/v2/url?u=https-3A__www.facebook.com_RaritanGroup_&d=DwMGaQ&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=h7KmwhwQTf-8idLOkUGqw_U9le4wAdZNjMPKN0d78EY&m=4OZSCmiNx6Z07N5dsJ74H30geLOwnkB7ayE-SDu4vuqk5Ign75FgFg0d93Uge6Ev&s=H57dB1O2o2bSuORmgMcnHErO_e1RiMgTv6XnCv9Wiic&e=>

[cid:[email protected]]<https://urldefense.proofpoint.com/v2/url?u=https-3A__www.instagram.com_raritangroup_&d=DwMGaQ&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=h7KmwhwQTf-8idLOkUGqw_U9le4wAdZNjMPKN0d78EY&m=4OZSCmiNx6Z07N5dsJ74H30geLOwnkB7ayE-SDu4vuqk5Ign75FgFg0d93Uge6Ev&s=nPo25COnj7-OSySHbw2OCEft90CVMoFnmhniAk2AmqE&e=>

[cid:[email protected]]<https://urldefense.proofpoint.com/v2/url?u=https-3A__www.linkedin.com_company_raritan-2Dgroup&d=DwMGaQ&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=h7KmwhwQTf-8idLOkUGqw_U9le4wAdZNjMPKN0d78EY&m=4OZSCmiNx6Z07N5dsJ74H30geLOwnkB7ayE-SDu4vuqk5Ign75FgFg0d93Uge6Ev&s=HrhD-7r61aUvRTEm6M-_T5zwiaQpf44BIiug2jS1LsU&e=>

[cid:[email protected]]<https://urldefense.proofpoint.com/v2/url?u=http-3A__www.raritangroup.com_&d=DwMGaQ&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=h7KmwhwQTf-8idLOkUGqw_U9le4wAdZNjMPKN0d78EY&m=4OZSCmiNx6Z07N5dsJ74H30geLOwnkB7ayE-SDu4vuqk5Ign75FgFg0d93Uge6Ev&s=rfIOv7BKoUwTEMXHA92V3Kl7rxdEz5GmFSbircg-B_Q&e=>









________________________________

This email has been scanned for spam and viruses. Click here<https://godaddy.cloud-protect.net/app/report_spam.php?mod_id=11&mod_option=logitem&report=1&type=easyspam&k=k1&payload=53616c7465645f5faef68e30375a5c06ddb3fe7f675a868f824c8cea6b0afa6ffbefd70edf8372f104debd39ce47a65aeee95c2e7032897c95a9f0933862028d8689ce61e3c26b18ac5a8c54d88277aa9feee1281be5eb4700be1dc17c1d03550ba81a4d98719e6d183afa3173206fe7cd5c68fe9950be6cb414738444b8a82e86e34c9445651510b677d48845a95da3a2245f7147367caa30b68520941c99a5> to report this email as spam.

_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

	To unsubscribe, send an email to:
	[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette