Re: Snort network interface issue
"Al Lewis \(allewi\) via Snort-users" <[email protected]> Fri, 11 Oct 2024 18:44:36 +0000
| Newsgroups | gmane.comp.security.ids.snort.general |
|---|---|
| Message-ID | <BL3PR11MB571549B0FF3F717977A2AD3CDA792@BL3PR11MB5715.namprd11.prod.outlook.com> |
--===============5945897382507181713== Content-Language: en-US Content-Type: multipart/alternative; boundary="_000_BL3PR11MB571549B0FF3F717977A2AD3CDA792BL3PR11MB5715namp_" --_000_BL3PR11MB571549B0FF3F717977A2AD3CDA792BL3PR11MB5715namp_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Traffic will need to be spanned to the snort interface. Albert Lewis Email: [email protected]<mailto:[email protected]> ________________________________ From: Snort-users <[email protected]> on behalf of Marwen= Soula via Snort-users <[email protected]> Sent: Thursday, October 10, 2024 11:42 AM To: [email protected] <[email protected]> Subject: [Snort-users] Snort network interface issue Hello, I am currently facing an issue with the Snort sensor not being able to capt= ure all network traffic. Here's the setup: I have a dedicated server connected to several cloud servers via a vSwitch. The vSwitch is configured to allow the dedicated server to reach the cloud = servers, and I have set the vSwitch network interface to promiscuous mode. However, the Snort sensor is unable to detect all traffic across the networ= k. For example, when Server A pings Server B, Snort doesn't capture this tr= affic. On the other hand, when a separate Server X pings the Snort server, = the traffic is detected. Could you please provide any recommendations or insights into resolving thi= s issue? Thank you for your assistance. Best regards, --_000_BL3PR11MB571549B0FF3F717977A2AD3CDA792BL3PR11MB5715namp_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable <html> <head> <meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Dus-ascii"= > <style type=3D"text/css" style=3D"display:none;"> P {margin-top:0;margin-bo= ttom:0;} </style> </head> <body dir=3D"ltr"> <div class=3D"elementToProof" style=3D"font-family: "Courier New"= , monospace; font-size: 12pt; color: rgb(0, 0, 0);"> Traffic will need to be spanned to the snort interface.</div> <div id=3D"Signature" class=3D"elementToProof"> <div style=3D"font-family: "Courier New", monospace; font-size: 1= 2pt; color: rgb(0, 0, 0);"> <br> </div> <div style=3D"font-family: "Courier New", monospace; font-size: 1= 2pt; color: rgb(0, 0, 0);"> <br> </div> <p style=3D"line-height: normal; margin: 0px; font-family: Courier; font-si= ze: 16px; color: rgb(30, 73, 125);"> <b>Albert Lewis</b></p> <p style=3D"line-height: normal; margin: 0px; font-family: Courier; font-si= ze: 15px; color: rgb(127, 127, 127);"> <span style=3D"font-size: 16px; color: rgb(153, 153, 153);">Email: </span><= span style=3D"font-size: 16px; color: rgb(128, 27, 128);"><u><a href=3D"mai= lto:[email protected]" id=3D"OWA23e47796-78fa-01ad-93b5-2405999696b4" class= =3D"OWAAutoLink" style=3D"color: rgb(128, 27, 128); margin-top: 0px; margin= -bottom: 0px;">[email protected]</a></u></span><span style=3D"font-size: 16p= x; color: rgb(79, 129, 189);"> </span></p> </div> <div id=3D"appendonsend"></div> <hr style=3D"display:inline-block;width:98%" tabindex=3D"-1"> <div id=3D"divRplyFwdMsg" dir=3D"ltr"><font face=3D"Calibri, sans-serif" st= yle=3D"font-size:11pt" color=3D"#000000"><b>From:</b> Snort-users <snort= [email protected]> on behalf of Marwen Soula via Snort-user= s <[email protected]><br> <b>Sent:</b> Thursday, October 10, 2024 11:42 AM<br> <b>To:</b> [email protected] <[email protected]><= br> <b>Subject:</b> [Snort-users] Snort network interface issue</font> <div> </div> </div> <style> <!-- @font-face {font-family:"Cambria Math"} @font-face {font-family:Aptos} p.x_MsoNormal, li.x_MsoNormal, div.x_MsoNormal {margin:0cm; font-size:11.0pt; font-family:"Aptos",sans-serif} span.x_EmailStyle17 {font-family:"Aptos",sans-serif; color:windowtext} .x_MsoChpDefault {font-size:11.0pt} @page WordSection1 {margin:70.85pt 70.85pt 2.0cm 70.85pt} div.x_WordSection1 {} --> </style> <div lang=3D"EN-GB" link=3D"#467886" vlink=3D"#96607D" style=3D"word-wrap:b= reak-word"> <div class=3D"x_WordSection1"> <p class=3D"x_MsoNormal">Hello, </p> <p class=3D"x_MsoNormal"> </p> <p class=3D"x_MsoNormal">I am currently facing an issue with the Snort sens= or not being able to capture all network traffic. </p> <p class=3D"x_MsoNormal">Here's the setup:</p> <p class=3D"x_MsoNormal"> </p> <p class=3D"x_MsoNormal">I have a dedicated server connected to several clo= ud servers via a vSwitch.</p> <p class=3D"x_MsoNormal">The vSwitch is configured to allow the dedicated s= erver to reach the cloud servers, and I have set the vSwitch network interf= ace to promiscuous mode.</p> <p class=3D"x_MsoNormal"> </p> <p class=3D"x_MsoNormal">However, the Snort sensor is unable to detect all = traffic across the network. For example, when Server A pings Server B, Snor= t doesn't capture this traffic. On the other hand, when a separate Server X= pings the Snort server, the traffic is detected.</p> <p class=3D"x_MsoNormal"> </p> <p class=3D"x_MsoNormal">Could you please provide any recommendations or in= sights into resolving this issue?</p> <p class=3D"x_MsoNormal"> </p> <p class=3D"x_MsoNormal">Thank you for your assistance.</p> <p class=3D"x_MsoNormal">Best regards,</p> <p class=3D"x_MsoNormal"> </p> </div> </div> </body> </html> --_000_BL3PR11MB571549B0FF3F717977A2AD3CDA792BL3PR11MB5715namp_-- --===============5945897382507181713== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Snort-users mailing list [email protected] Go to this URL to change user options or unsubscribe: https://lists.snort.org/mailman/listinfo/snort-users To unsubscribe, send an email to: [email protected] Please visit http://blog.snort.org to stay current on all the latest Snort news! Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette --===============5945897382507181713==--