RE: [sentinix-list] NIC / Routing Tables

Hi Bill,
 So, if I give eth0 and bogus IP# of 0.0.0.0 with netmask 255.255.255.0 and
eth1 with a good IP of 192.168.1.x and 255.255.255.0 and add a default
gateway entry to the route table for eth1 all should be well?

 I’ll try it on Monday and see how it goes, if you’ve done it and gotten it
to work please confirm.

Thanks,
Michael

-----Original Message-----
From: OMalley, Bill [mailto:Bill.OMalley-3ekG96uVUrBWk0Htik3J/[email protected]]
Sent: Saturday, January 17, 2004 6:12 PM
To: The SENTINIX Mailing List; M. Morgan
Subject: RE: [sentinix-list] NIC / Routing Tables

This is similar to the problem I mentioned on earlier post.  The second NIC
(eth1) does not have s Default GW when set yp through the setup.  You'll
need to enter the "route add" command to add the GW for the second NIC.

   route add default gw 192.168.1.1 eth1

Good luck,
Bill O'Malley


-----Original Message-----
From:   Terkanian, Greg [ mailto:[email protected]]
Sent:   Fri 1/16/2004 2:54 PM
To:     M. Morgan; The SENTINIX Mailing List
Cc:
Subject:        RE: [sentinix-list] NIC / Routing Tables
I had a similar problem on a Windows machine where I had a LAN interface,
and a high-speed point to point interface, that connected to a database
server (I didn't want contention when communicating with the database).  I
found that as soon as the server communicated with the db server, I lost LAN
connectivity to it.  The short story is I removed the default gateway
address from the secondary interface, and it stopped trying to route traffic
out it.


-----Original Message-----
From: sentinix-bounces-y1CeFY8bYInMlQukkHbAVdBPR1lH4CV8@public.gmane.org
[ mailto:sentinix-bounces-y1CeFY8bYInMlQukkHbAVdBPR1lH4CV8@public.gmane.org]On Behalf Of M. Morgan
Sent: Friday, January 16, 2004 1:23 PM
To: [email protected]; [email protected]
Subject: [sentinix-list] NIC / Routing Tables


Hello all,
 I've encountered a problem on my remote sensors that I cant seem to
resolve. It is my intent to have 1 NIC on the sniffed network and 1 NIC on
the "safe" admin network where the MySQL server resides (say .29).

 However, when I plug eth0 into the sniffed network I lose contact with the
sensor box altogether. The reason for this seems to be that the "route
table" is using eth0 by defualt for all traffic.

 Also, the MySQL server demands that the IP# of eth0 have database access
because the machine is trying to route all traffic through eth0. I need
OUTBOUND traffic routed through eth1 (it's on the same LAN as the server and
for admin connectivity). I use "route" at a terminal to display the table.

I havent been able to configure eth0 without an IP at all as the snortcenter
"add sensor" setup seems to require one. Since I cant get it done that way I
"intended" to put a LAN IP on eth0 and discard all connection attempts via
iptables.

 Here are the specs for the NIC's:

192.168.1.30 = eth0 = marked as "interface to sniff" in snortcenter =
plugged into a hostile sniffed network
192.168.1.31 = eth1 = admin NIC = plugged into trusted LAN with mysql server

 I'm working on modifying a table now but if anyone has pointers, examples
or a way to setup the sniffed NIC without an IP# feel free to contribute.

thanks,
Michael
_______________________________________________
SENTINIX mailing list
[email protected]
http://elevenprospect.com/mailman/listinfo/sentinix
_______________________________________________
SENTINIX mailing list
[email protected]
http://elevenprospect.com/mailman/listinfo/sentinix






THIS MESSAGE MAY CONTAIN INFORMATION THAT IS CONFIDENTIAL AND/OR PROTECTED
BY LAW. IF THE READER OF THIS MESSAGE IS NOT THE INTENDED RECIPIENT, YOU ARE
HEREBY NOTIFIED THAT ANY DISSEMINATION, DISTRIBUTION, COPYING OR
COMMUNICATION OF THIS MESSAGE IS STRICTLY PROHIBITED. IF YOU HAVE RECEIVED
THIS COMMUNICATION IN ERROR, PLEASE CONTACT THE SENDER IMMEDIATELY AND
DELETE THE MESSAGE. PLEASE NOTE THAT ALTHOUGH WE WILL TAKE ALL COMMERCIALLY
REASONABLE EFFORTS TO PREVENT VIRUSES FROM BEING TRANSMITTED FROM OUR
SYSTEMS, IT IS THE RESPONSIBILITY OF THE RECIPIENT TO CHECK FOR AND PREVENT
ADVERSE ACTION BY VIRUSES ON ITS OWN SYSTEMS .