[11163] in bugtraq
Re: Antisniff thoughts
daemon@ATHENA.MIT.EDU (Craig H. Rowland)
Wed Jul 28 04:40:58 1999
Mime-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Message-Id: <Pine.LNX.4.04.9907270012430.5591-100000@dolemite.psionic.com>
Date: Tue, 27 Jul 1999 00:17:30 -0500
Reply-To: "Craig H. Rowland" <crowland@PSIONIC.COM>
From: "Craig H. Rowland" <crowland@PSIONIC.COM>
X-To: *Hobbit* <hobbit@AVIAN.ORG>
To: BUGTRAQ@SECURITYFOCUS.COM
In-Reply-To: <199907260200.WAA00812@narq.avian.org>
FYI,
> Workaround: one interface as a normal address on a normal reachable net, and a
> second interface configured as above sniffing a *different* net. Useful
> setup for remotely-administerable IDS boxes; real address lives on a protected
> inside net, sniffing interface plugs in to watch the dirty one but is not
> addressable.
Cisco NetRanger is setup this way by default. One interface is for command
and control and is usually isolated. The sniffing interface has no
protocols bound to it. This is for a variety of reasons, the main one
being it isolates the IDS from direct attack. Not a product plug, just a
note that some people do this already.
-- Craig
