Re: [sentinix-list] Sentinix with two nics

Here's how I did it:

 As Michel stated one NIC will have a valid IP, this will be your admin NIC and the NIC your routing table points to for network access. The other can have 0.0.0.0/255.255.255.255 and no default route.

like so:
eth 0 / sniffing NIC / 0.0.0.0-255.255.255.255
eth 1 / admin NIC / 192.168.x.x / 255.255.255.0

you'll need to setup iptables/chains whichever the firewall is to drop all incoming (unsoliceted) connections on the sniffing NIC (eth 0).

you'll probably need to edit the routing table as well to make sure that the admin NIC has a default gateway (and remove the gateway route for the sniffing NIC) . 

use "man route" to figure out the syntax to edit the routeing table.

Reply back with history if you have further questions.

thanks,
michael 



-----Original Message-----
From: Michel Blomgren <[email protected]>
Sent: May 11, 2004 8:24 PM
To: The SENTINIX Mailing List <[email protected]>
Subject: Re: [sentinix-list] Sentinix with two nics

On Tuesday 11 May 2004 18:15, Wells, Cary wrote:
> Can you set up Sentinix with two nics?  I have one connected directly to a
> span nic on my openbsd transparent bridge.  This does not have inet access
> so I need to use a second nic to connect to this box.  Question is, can I
> set the first nic up so that it just istens and captures all the data sent
> through the span and then have the second nic for connecting?  The first
> nic wouldn't need an ip.
> _______________________________________________
> SENTINIX mailing list
> [email protected]
> http://elevenprospect.com/mailman/listinfo/sentinix

Of course!

You have to have an ip for that interface though, just use any fubar IP with 
netmask 255.255.255.255... and make sure forwarding is completely off on that 
interface (or add netfilter rules, etc.).

/Michel

_______________________________________________
SENTINIX mailing list
[email protected]
http://elevenprospect.com/mailman/listinfo/sentinix