RE: [sentinix-list] NIC / Routing Tables

I had a similar problem on a Windows machine where I had a LAN interface, and a high-speed point to point interface, that connected to a database server (I didn't want contention when communicating with the database).  I found that as soon as the server communicated with the db server, I lost LAN connectivity to it.  The short story is I removed the default gateway address from the secondary interface, and it stopped trying to route traffic out it.


-----Original Message-----
From: sentinix-bounces-y1CeFY8bYInMlQukkHbAVdBPR1lH4CV8@public.gmane.org
[mailto:sentinix-bounces-y1CeFY8bYInMlQukkHbAVdBPR1lH4CV8@public.gmane.org]On Behalf Of M. Morgan
Sent: Friday, January 16, 2004 1:23 PM
To: [email protected]; [email protected]
Subject: [sentinix-list] NIC / Routing Tables


Hello all,
 I've encountered a problem on my remote sensors that I cant seem to resolve. It is my intent to have 1 NIC on the sniffed network and 1 NIC on the "safe" admin network where the MySQL server resides (say .29). 

 However, when I plug eth0 into the sniffed network I lose contact with the sensor box altogether. The reason for this seems to be that the "route table" is using eth0 by defualt for all traffic.

 Also, the MySQL server demands that the IP# of eth0 have database access because the machine is trying to route all traffic through eth0. I need OUTBOUND traffic routed through eth1 (it's on the same LAN as the server and for admin connectivity). I use "route" at a terminal to display the table.

I havent been able to configure eth0 without an IP at all as the snortcenter "add sensor" setup seems to require one. Since I cant get it done that way I "intended" to put a LAN IP on eth0 and discard all connection attempts via iptables.

 Here are the specs for the NIC's:

192.168.1.30 = eth0 = marked as "interface to sniff" in snortcenter = plugged into a hostile sniffed network
192.168.1.31 = eth1 = admin NIC = plugged into trusted LAN with mysql server

 I'm working on modifying a table now but if anyone has pointers, examples or a way to setup the sniffed NIC without an IP# feel free to contribute.

thanks,
Michael
_______________________________________________
SENTINIX mailing list
[email protected]
http://elevenprospect.com/mailman/listinfo/sentinix