RE: [sentinix-list] NIC / Routing Tables

This is similar to the problem I mentioned on earlier post.  The second NIC (eth1) does not have s Default GW when set yp through the setup.  You'll need to enter the "route add" command to add the GW for the second NIC.

   route add default gw 192.168.1.1 eth1

Good luck,
Bill O'Malley


-----Original Message-----
From:	Terkanian, Greg [mailto:[email protected]]
Sent:	Fri 1/16/2004 2:54 PM
To:	M. Morgan; The SENTINIX Mailing List
Cc:	
Subject:	RE: [sentinix-list] NIC / Routing Tables
I had a similar problem on a Windows machine where I had a LAN interface, and a high-speed point to point interface, that connected to a database server (I didn't want contention when communicating with the database).  I found that as soon as the server communicated with the db server, I lost LAN connectivity to it.  The short story is I removed the default gateway address from the secondary interface, and it stopped trying to route traffic out it.


-----Original Message-----
From: sentinix-bounces-y1CeFY8bYInMlQukkHbAVdBPR1lH4CV8@public.gmane.org
[mailto:sentinix-bounces-y1CeFY8bYInMlQukkHbAVdBPR1lH4CV8@public.gmane.org]On Behalf Of M. Morgan
Sent: Friday, January 16, 2004 1:23 PM
To: [email protected]; [email protected]
Subject: [sentinix-list] NIC / Routing Tables


Hello all,
 I've encountered a problem on my remote sensors that I cant seem to resolve. It is my intent to have 1 NIC on the sniffed network and 1 NIC on the "safe" admin network where the MySQL server resides (say .29). 

 However, when I plug eth0 into the sniffed network I lose contact with the sensor box altogether. The reason for this seems to be that the "route table" is using eth0 by defualt for all traffic.

 Also, the MySQL server demands that the IP# of eth0 have database access because the machine is trying to route all traffic through eth0. I need OUTBOUND traffic routed through eth1 (it's on the same LAN as the server and for admin connectivity). I use "route" at a terminal to display the table.

I havent been able to configure eth0 without an IP at all as the snortcenter "add sensor" setup seems to require one. Since I cant get it done that way I "intended" to put a LAN IP on eth0 and discard all connection attempts via iptables.

 Here are the specs for the NIC's:

192.168.1.30 = eth0 = marked as "interface to sniff" in snortcenter = plugged into a hostile sniffed network
192.168.1.31 = eth1 = admin NIC = plugged into trusted LAN with mysql server

 I'm working on modifying a table now but if anyone has pointers, examples or a way to setup the sniffed NIC without an IP# feel free to contribute.

thanks,
Michael
_______________________________________________
SENTINIX mailing list
[email protected]
http://elevenprospect.com/mailman/listinfo/sentinix
_______________________________________________
SENTINIX mailing list
[email protected]
http://elevenprospect.com/mailman/listinfo/sentinix







THIS MESSAGE MAY CONTAIN INFORMATION THAT IS CONFIDENTIAL AND/OR PROTECTED BY LAW. IF THE READER OF THIS MESSAGE IS NOT THE INTENDED RECIPIENT, YOU ARE HEREBY NOTIFIED THAT ANY DISSEMINATION, DISTRIBUTION, COPYING OR COMMUNICATION OF THIS MESSAGE IS STRICTLY PROHIBITED. IF YOU HAVE RECEIVED THIS COMMUNICATION IN ERROR, PLEASE  CONTACT  THE SENDER IMMEDIATELY AND DELETE THE MESSAGE.  PLEASE NOTE THAT  ALTHOUGH WE WILL TAKE ALL COMMERCIALLY REASONABLE EFFORTS TO PREVENT VIRUSES FROM BEING TRANSMITTED FROM OUR SYSTEMS, IT IS THE RESPONSIBILITY OF THE RECIPIENT TO CHECK FOR AND PREVENT ADVERSE ACTION BY VIRUSES ON ITS OWN SYSTEMS .

_______________________________________________
SENTINIX mailing list
[email protected]
http://elevenprospect.com/mailman/listinfo/sentinix