Re: Snort network interface issue
Ron Jenkins via Snort-users <[email protected]> Fri, 11 Oct 2024 19:10:01 +0000
| Newsgroups | gmane.comp.security.ids.snort.general |
|---|---|
| Message-ID | <SN6PR13MB2432BF46378B9EE02053429BE1792@SN6PR13MB2432.namprd13.prod.outlook.com> |
--===============7337516616541627340== Content-Language: en-US Content-Type: multipart/alternative; boundary="_000_SN6PR13MB2432BF46378B9EE02053429BE1792SN6PR13MB2432namp_" --_000_SN6PR13MB2432BF46378B9EE02053429BE1792SN6PR13MB2432namp_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Port mirror or tap Ron Jenkins (Owner / Senior Architect / Cyber Security Consultant) RMJ Consulting, LLC. " Supporting Companies with their Technology needs" 11715 Bricksome Ave STE B-7 Baton Rouge, LA 70816 Direct. 225-448-5214 Ext #101 Cell. 225-931-1632 Web. http://www.rmjconsulting.net<http://www.rmjconsulting.net/> Log Siphon. http://www.logsiphon.com<http://www.logsiphon.com/> Linkedin. www.linkedin.com/in/ronmjenkins/<http://www.linkedin.com/in/ronmj= enkins/> Twitter: www.twitter.com/RMJConsulting<http://www.twitter.com/RMJConsulting> Facebook: www.facebook.com/rmjcsconsulting<http://www.facebook.com/rmjcscon= sulting> ________________________________ From: Snort-users <[email protected]> on behalf of Al Lew= is (allewi) via Snort-users <[email protected]> Sent: Friday, October 11, 2024 1:44:36 PM To: [email protected] <[email protected]>; Marwen Soula= <[email protected]> Subject: Re: [Snort-users] Snort network interface issue CAUTION: This email originated from outside your organization. Exercise cau= tion when opening attachments or clicking links, especially from unknown se= nders. Traffic will need to be spanned to the snort interface. Albert Lewis Email: [email protected]<mailto:[email protected]> ________________________________ From: Snort-users <[email protected]> on behalf of Marwen= Soula via Snort-users <[email protected]> Sent: Thursday, October 10, 2024 11:42 AM To: [email protected] <[email protected]> Subject: [Snort-users] Snort network interface issue Hello, I am currently facing an issue with the Snort sensor not being able to capt= ure all network traffic. Here's the setup: I have a dedicated server connected to several cloud servers via a vSwitch. The vSwitch is configured to allow the dedicated server to reach the cloud = servers, and I have set the vSwitch network interface to promiscuous mode. However, the Snort sensor is unable to detect all traffic across the networ= k. For example, when Server A pings Server B, Snort doesn't capture this tr= affic. On the other hand, when a separate Server X pings the Snort server, = the traffic is detected. Could you please provide any recommendations or insights into resolving thi= s issue? Thank you for your assistance. Best regards, PRIVILEGED & CONFIDENTIAL COMMUNICATION: The information contained in this transmission may be privileged, confident= ial, and exempt from disclosure under applicable law. It is intended only f= or the use of the intended recipient. If you are not the intended recipient= , you are hereby on notice that any unauthorized disclosure, dissemination,= distribution, duplication, or taking any action in reliance on the content= s of the electronically transmitted materials or contents of this communica= tion is strictly prohibited. If you have received this communication in err= or, please contact the sender by reply e-mail and destroy all copies of the= original message. = --_000_SN6PR13MB2432BF46378B9EE02053429BE1792SN6PR13MB2432namp_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable <html> <head> <meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Dus-ascii"> </head> <body> <div dir=3D"auto">Port mirror or tap</div> <div><br> </div> <div id=3D"ms-outlook-mobile-signature" dir=3D"auto"> <p style=3D"margin:0in;font-size:11pt;font-family:Calibri, sans-serif"><spa= n style=3D"font-size:9pt;line-height:1.5">Ron Jenkins (Owner / Senior Archi= tect / Cyber Security Consultant)</span></p> <p style=3D"margin:0in;font-size:11pt;font-family:Calibri, sans-serif"><b><= span style=3D"font-size:9pt;line-height:1.5">RMJ Consulting, LLC.<span>&nbs= p;</span></span></b><span style=3D"font-size:9pt;line-height:1.5">"</s= pan><span> </span><i><span style=3D"font-size:9pt;line-height:1.5">Sup= porting Companies with their Technology needs</span></i><span style=3D"font-size:9= pt;line-height:1.5">"</span></p> <p style=3D"margin:0in;font-size:11pt;font-family:Calibri, sans-serif"><spa= n style=3D"font-size:9pt;line-height:1.5">11715 Bricksome Ave STE B-7</span= ></p> <p style=3D"margin:0in;font-size:11pt;font-family:Calibri, sans-serif"><spa= n style=3D"font-size:9pt;line-height:1.5">Baton Rouge, LA 70816</span></p> <p style=3D"margin:0in;font-size:11pt;font-family:Calibri, sans-serif"><b><= span style=3D"font-size:9pt;line-height:1.5">Direct</span></b><span style= =3D"font-size:9pt;line-height:1.5"><span style=3D""><span style=3D"">.<span= > </span><a style=3D"text-decoration: underline; color: rgb(5, 99, 193= );">225-448-5214</a><span> </span>Ext #101</span></span></span></p> <p style=3D"margin:0in;font-size:11pt;font-family:Calibri, sans-serif"><b><= span style=3D"font-size:9pt;line-height:1.5">Cell.</span></b><span style=3D= "font-size:9pt;line-height:1.5"><span style=3D""><span style=3D""><span>&nb= sp;</span><a style=3D"text-decoration: underline; color: rgb(5, 99, 193);">= 225-931-1632</a></span></span></span></p> <p style=3D"margin:0in;font-size:11pt;font-family:Calibri, sans-serif"><b><= span style=3D"font-size:9pt;line-height:1.5">Web.</span></b><span style=3D"= font-size:9pt;line-height:1.5"><span> </span></span><a href=3D"http://= www.rmjconsulting.net/" data-outlook-id=3D"bb1eb706-3efa-41c6-9e6f-357b897b= e04e" data-linkindex=3D"0" style=3D"text-decoration: underline; color: rgb(= 5, 99, 193);"><span style=3D"font-size:9pt;line-height:1.5">http://www.rmjc= onsulting.net</span></a><span style=3D"font-size:9pt;line-height:1.5"></spa= n></p> <p style=3D"margin:0in;font-size:11pt;font-family:Calibri, sans-serif"><b><= span style=3D"font-size:9pt;line-height:1.5">Log Siphon</span></b><span sty= le=3D"font-size:9pt;line-height:1.5">.<span> </span></span><a href=3D"= http://www.logsiphon.com/" data-outlook-id=3D"9a27d6f4-ffdc-4707-9d25-cc5c6= 7079fef" data-linkindex=3D"1" style=3D"text-decoration: underline; color: r= gb(5, 99, 193);"><span style=3D"font-size:9pt;line-height:1.5">http://www.l= ogsiphon.com</span></a><span style=3D"font-size:9pt;line-height:1.5"></span= ></p> <p style=3D"margin:0in;font-size:11pt;font-family:Calibri, sans-serif"><b><= span style=3D"font-size:9pt;line-height:1.5">Linkedin.</span></b><span styl= e=3D"font-size:9pt;line-height:1.5"><span> </span></span><a data-outlo= ok-id=3D"978f80b0-96f3-436e-9eaf-cda7ba605e36" data-linkindex=3D"2"></a><a = href=3D"http://www.linkedin.com/in/ronmjenkins/" title=3D"View public profi= le" data-outlook-id=3D"c4fbcd80-c342-44c3-82eb-a9d9b6f5eccb" data-linkindex= =3D"3" style=3D"text-decoration: underline; color: rgb(5, 99, 193);"><span>= <span style=3D"font-size:9pt;line-height:1.5">www.linkedin.com/in/ronmjenki= ns/</span></span><span></span></a><span></span><span style=3D"font-size:9pt= ;line-height:1.5"></span></p> <p style=3D"margin:0in;font-size:11pt;font-family:Calibri, sans-serif"><b><= span style=3D"font-size:9pt;line-height:1.5">Twitter:</span></b><span style= =3D"font-size:9pt;line-height:1.5"><span> </span></span><a href=3D"htt= p://www.twitter.com/RMJConsulting" data-outlook-id=3D"ec131f03-330c-463b-8b= 82-9601fb7f2477" data-linkindex=3D"4" style=3D"text-decoration: underline; = color: rgb(5, 99, 193);"><span style=3D"font-size:9pt;line-height:1.5">www.= twitter.com/RMJConsulting</span></a><span style=3D"font-size:9pt;line-heigh= t:1.5"></span></p> <p style=3D"margin:0in;font-size:11pt;font-family:Calibri, sans-serif"><b><= span style=3D"font-size:9pt;line-height:1.5">Facebook:<span> </span></= span></b><a href=3D"http://www.facebook.com/rmjcsconsulting" data-outlook-i= d=3D"47863c5e-6bd0-4837-b41c-7b2e7272ad8f" data-linkindex=3D"5" style=3D"te= xt-decoration: underline; color: rgb(5, 99, 193);"><span style=3D"font-size= :9pt;line-height:1.5">www.facebook.com/rmjcsconsulting</span></a></p> <p style=3D"margin:0in;font-size:11pt;font-family:Calibri, sans-serif"><spa= n style=3D"font-size:9pt;line-height:1.5"></span></p> <p style=3D"margin:0in;font-size:11pt;font-family:Calibri, sans-serif"></p> </div> <hr style=3D"display:inline-block;width:98%" tabindex=3D"-1"> <div id=3D"divRplyFwdMsg" dir=3D"ltr"><font face=3D"Calibri, sans-serif" st= yle=3D"font-size:11pt" color=3D"#000000"><b>From:</b> Snort-users <snort= [email protected]> on behalf of Al Lewis (allewi) via Snort= -users <[email protected]><br> <b>Sent:</b> Friday, October 11, 2024 1:44:36 PM<br> <b>To:</b> [email protected] <[email protected]>;= Marwen Soula <[email protected]><br> <b>Subject:</b> Re: [Snort-users] Snort network interface issue</font> <div> </div> </div> <div> <p>CAUTION: This email originated from outside your organization. Exercise = caution when opening attachments or clicking links, especially from unknown= senders.<br> </p> <style type=3D"text/css" style=3D"display:none"> <!-- p {margin-top:0; margin-bottom:0} --> </style> <div class=3D"x_elementToProof" style=3D"font-family:"Courier New"= ;,monospace; font-size:12pt; color:rgb(0,0,0)"> Traffic will need to be spanned to the snort interface.</div> <div id=3D"x_Signature" class=3D"x_elementToProof"> <div style=3D"font-family:"Courier New",monospace; font-size:12pt= ; color:rgb(0,0,0)"> <br> </div> <div style=3D"font-family:"Courier New",monospace; font-size:12pt= ; color:rgb(0,0,0)"> <br> </div> <p style=3D"line-height:normal; margin:0px; font-family:Courier; font-size:= 16px; color:rgb(30,73,125)"> <b>Albert Lewis</b></p> <p style=3D"line-height:normal; margin:0px; font-family:Courier; font-size:= 15px; color:rgb(127,127,127)"> <span style=3D"font-size:16px; color:rgb(153,153,153)">Email: </span><span = style=3D"font-size:16px; color:rgb(128,27,128)"><u><a href=3D"mailto:allewi= @cisco.com" id=3D"OWA23e47796-78fa-01ad-93b5-2405999696b4" class=3D"x_OWAAu= toLink" style=3D"color:rgb(128,27,128); margin-top:0px; margin-bottom:0px">= [email protected]</a></u></span><span style=3D"font-size:16px; color:rgb(79,= 129,189)"> </span></p> </div> <div id=3D"x_appendonsend"></div> <hr tabindex=3D"-1" style=3D"display:inline-block; width:98%"> <div id=3D"x_divRplyFwdMsg" dir=3D"ltr"><font face=3D"Calibri, sans-serif" = color=3D"#000000" style=3D"font-size:11pt"><b>From:</b> Snort-users <sno= [email protected]> on behalf of Marwen Soula via Snort-us= ers <[email protected]><br> <b>Sent:</b> Thursday, October 10, 2024 11:42 AM<br> <b>To:</b> [email protected] <[email protected]><= br> <b>Subject:</b> [Snort-users] Snort network interface issue</font> <div> </div> </div> <style> <!-- @font-face {font-family:"Cambria Math"} @font-face {font-family:Aptos} p.x_x_MsoNormal, li.x_x_MsoNormal, div.x_x_MsoNormal {margin:0cm; font-size:11.0pt; font-family:"Aptos",sans-serif} span.x_x_EmailStyle17 {font-family:"Aptos",sans-serif; color:windowtext} .x_x_MsoChpDefault {font-size:11.0pt} @page WordSection1 {margin:70.85pt 70.85pt 2.0cm 70.85pt} --> </style> <div lang=3D"EN-GB" style=3D"word-wrap:break-word"> <div class=3D"x_x_WordSection1"> <p class=3D"x_x_MsoNormal">Hello, </p> <p class=3D"x_x_MsoNormal"> </p> <p class=3D"x_x_MsoNormal">I am currently facing an issue with the Snort se= nsor not being able to capture all network traffic. </p> <p class=3D"x_x_MsoNormal">Here's the setup:</p> <p class=3D"x_x_MsoNormal"> </p> <p class=3D"x_x_MsoNormal">I have a dedicated server connected to several c= loud servers via a vSwitch.</p> <p class=3D"x_x_MsoNormal">The vSwitch is configured to allow the dedicated= server to reach the cloud servers, and I have set the vSwitch network inte= rface to promiscuous mode.</p> <p class=3D"x_x_MsoNormal"> </p> <p class=3D"x_x_MsoNormal">However, the Snort sensor is unable to detect al= l traffic across the network. For example, when Server A pings Server B, Sn= ort doesn't capture this traffic. On the other hand, when a separate Server= X pings the Snort server, the traffic is detected.</p> <p class=3D"x_x_MsoNormal"> </p> <p class=3D"x_x_MsoNormal">Could you please provide any recommendations or = insights into resolving this issue?</p> <p class=3D"x_x_MsoNormal"> </p> <p class=3D"x_x_MsoNormal">Thank you for your assistance.</p> <p class=3D"x_x_MsoNormal">Best regards,</p> <p class=3D"x_x_MsoNormal"> </p> </div> </div> </div> </body> </html> <html><body></i></b><p>PRIVILEGED & CONFIDENTIAL COMMUNICATION:<br> The information contained in this transmission may be privileged, confident= ial, and exempt from disclosure under applicable law. It is intended only f= or the use of the intended recipient. If you are not the intended recipient= , you are hereby on notice that any unauthorized disclosure, dissemination,= distribution, duplication, or taking any action in reliance on the content= s of the electronically transmitted materials or contents of this communica= tion is strictly prohibited. If you have received this communication in err= or, please contact the sender by reply e-mail and destroy all copies of the= original message. <br> </p></body></html> --_000_SN6PR13MB2432BF46378B9EE02053429BE1792SN6PR13MB2432namp_-- --===============7337516616541627340== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Snort-users mailing list [email protected] Go to this URL to change user options or unsubscribe: https://lists.snort.org/mailman/listinfo/snort-users To unsubscribe, send an email to: [email protected] Please visit http://blog.snort.org to stay current on all the latest Snort news! Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette --===============7337516616541627340==--