Share your knowledge at the LQ Wiki.
Go Back > Forums > Linux Forums > Linux - Security
User Name
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.


  Search this Thread
Old 11-28-2004, 08:15 PM   #1
Registered: Apr 2003
Posts: 152

Rep: Reputation: Disabled
snort, best place in network

which place would be best to place a snort box:

1) internet router --> firewall --> eth0, snort box eth1 --> network switch -->LAN


2) internet router --> firewall --> network switch --> LAN with snort box

In setup one, would I also see scans from inside the LAN? Any advice / suggestions ? What would be the pros or cons from either config.

Old 11-29-2004, 09:47 AM   #2
Registered: Nov 2004
Location: Toledo, OH
Distribution: SuSE 9.2 Pro
Posts: 53

Rep: Reputation: 15
If I were you... it sounds like you have a Router and Two computers to me....

I would set up snort on eth0
you then have eth1 which the other computer connects to, correct?

If you have it set up like this....

Modem -> Router -> firewall {eth0 -> eth1} -> eth0?

{} = computer #1

I'm assuming your using twisted cable or a switch between computer one and two.....

You know your Router can act as your firewall right?
It's good to configure iptables on your first computer too if you want the extra assurance.....

Anyways, Like I have it above, Snort will view all traffic coming from computer 1 and computer 2 as well as all incomming traffic to both computers....

also snort will see any traffic, including the traffic that iptables denies.... cause it hits snort before it hits your iptables firewall.....

Hope this helps some....


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off

Similar Threads
Thread Thread Starter Forum Replies Last Post
Error when starting up snort: bash:!/bin/sh/usr/local/bin/snort :Eent not found cynthia_thomas Linux - Software 1 11-11-2005 03:59 PM
Linux looks for network card in wrong place TrulyTessa Linux - Networking 4 11-02-2004 11:06 AM
Snort, Highspeed Network Packet Loss Tmor Linux - Enterprise 5 08-18-2004 04:24 PM
Where to place Snort Sensors kahpeetan Linux - Security 5 11-17-2003 07:40 PM
Network speed 10 mbps in place of 100 mbps? /su Linux - Networking 11 06-18-2003 08:11 AM > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 02:44 PM.

Main Menu
Write for LQ is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration