RE: [sentinix-list] NIC / Routing Tables

Michael,

There are no "routing" or "configuration" problems that I can see.  It's purely
an access problem once eth0 is spanned and there isn't a GW on eth1.

I wouldn't suggest giving eth0 a bogus IP.  I've had no problems getting
Sentinix to recognize eth0 or eth1.  My only problem was getting Sentinix to
recognize the GW for eth1 without manually setting it.  Once eth0 is "spanned",
the port is inaccessible (e.g. Cisco 3550).  A GW must be set on eth1 in order
to browse to the Sentinix box.

I would suggest giving your eth0 a valid IP or use DHCP.  You will also need a
valid IP (and defined GW) for your eth1 in order to access remotely.

Regards,
Bill O'Malley


-----Original Message-----
From: Michel Blomgren [mailto:[email protected]]
Sent: Monday, January 19, 2004 6:03 AM
To: The SENTINIX Mailing List
Subject: Re: [sentinix-list] NIC / Routing Tables


Just a quick reply here, have very little time!

You all got routing problems and bad configuration problems!

give eth0 a bogus IP, a private one. Most don't use 172.16. perhaps you can 
use this. Netmask should be 255.255.255.255 (CIDR /32), this makes no traffic 
going out of the interface unless it's to the interface's own address. eth1 
should have a netmask in which your default gateway falls within, for 
example: eth1 = 192.168.1.100 netmask 255.255.0.0, default gw = 
192.168.0.254.

Check the default gw in "route", especially the field which says which 
interface it's routing through.

For the eth0 IP, set up a null route _or_ add a few iptables lines to 
forcefully block everything coming in (and out) on the interface. Make sure 
eth0 isn't routing any packets through the box, or that the box in itself 
isn't answering anything.

Connect your mirrored (spanned) RJ45 to eth0 and type tcpdump -i eth0 to see 
if there's any activity.  Use tcpdump (not snort) to check if you receive 
anything, becomes much simpler than checking snort logs and you get the 
answer right away.

	Michel

On Monday 19 January 2004 04:17, Michael Morgan wrote:
> Hi Bill,
>  So, if I give eth0 and bogus IP# of 0.0.0.0 with netmask 255.255.255.0 and
> eth1 with a good IP of 192.168.1.x and 255.255.255.0 and add a default
> gateway entry to the route table for eth1 all should be well?
>
>  I’ll try it on Monday and see how it goes, if you’ve done it and gotten it
> to work please confirm.
>
> Thanks,
> Michael
>
> -----Original Message-----
> From: OMalley, Bill [mailto:Bill.OMalley-3ekG96uVUrBWk0Htik3J/[email protected]]
> Sent: Saturday, January 17, 2004 6:12 PM
> To: The SENTINIX Mailing List; M. Morgan
> Subject: RE: [sentinix-list] NIC / Routing Tables
>
> This is similar to the problem I mentioned on earlier post.  The second NIC
> (eth1) does not have s Default GW when set yp through the setup.  You'll
> need to enter the "route add" command to add the GW for the second NIC.
>
>    route add default gw 192.168.1.1 eth1
>
> Good luck,
> Bill O'Malley
>
>
> -----Original Message-----
> From:   Terkanian, Greg [ mailto:[email protected]]
> Sent:   Fri 1/16/2004 2:54 PM
> To:     M. Morgan; The SENTINIX Mailing List
> Cc:
> Subject:        RE: [sentinix-list] NIC / Routing Tables
> I had a similar problem on a Windows machine where I had a LAN interface,
> and a high-speed point to point interface, that connected to a database
> server (I didn't want contention when communicating with the database).  I
> found that as soon as the server communicated with the db server, I lost
> LAN connectivity to it.  The short story is I removed the default gateway
> address from the secondary interface, and it stopped trying to route
> traffic out it.
>
>
> -----Original Message-----
> From: sentinix-bounces-y1CeFY8bYInMlQukkHbAVdBPR1lH4CV8@public.gmane.org
> [ mailto:sentinix-bounces-y1CeFY8bYInMlQukkHbAVdBPR1lH4CV8@public.gmane.org]On Behalf Of M. Morgan
> Sent: Friday, January 16, 2004 1:23 PM
> To: [email protected]; [email protected]
> Subject: [sentinix-list] NIC / Routing Tables
>
>
> Hello all,
>  I've encountered a problem on my remote sensors that I cant seem to
> resolve. It is my intent to have 1 NIC on the sniffed network and 1 NIC on
> the "safe" admin network where the MySQL server resides (say .29).
>
>  However, when I plug eth0 into the sniffed network I lose contact with the
> sensor box altogether. The reason for this seems to be that the "route
> table" is using eth0 by defualt for all traffic.
>
>  Also, the MySQL server demands that the IP# of eth0 have database access
> because the machine is trying to route all traffic through eth0. I need
> OUTBOUND traffic routed through eth1 (it's on the same LAN as the server
> and for admin connectivity). I use "route" at a terminal to display the
> table.
>
> I havent been able to configure eth0 without an IP at all as the
> snortcenter "add sensor" setup seems to require one. Since I cant get it
> done that way I "intended" to put a LAN IP on eth0 and discard all
> connection attempts via iptables.
>
>  Here are the specs for the NIC's:
>
> 192.168.1.30 = eth0 = marked as "interface to sniff" in snortcenter =
> plugged into a hostile sniffed network
> 192.168.1.31 = eth1 = admin NIC = plugged into trusted LAN with mysql
> server
>
>  I'm working on modifying a table now but if anyone has pointers, examples
> or a way to setup the sniffed NIC without an IP# feel free to contribute.
>
> thanks,
> Michael
> _______________________________________________
> SENTINIX mailing list
> [email protected]
> http://elevenprospect.com/mailman/listinfo/sentinix

_______________________________________________
SENTINIX mailing list
[email protected]
http://elevenprospect.com/mailman/listinfo/sentinix