This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sniffing interface

I don't see a selection for promiscuous in the interface tab to set a device into sniffing mode. What I would like to do is add a couple additional NICs to my box and route my SPAN ports on my switches back to these interfaces. Am I looking in the wrong spot (UTM Home)?

This thread was automatically locked due to age.

0 BarryG over 11 years ago

Hi,
What are you trying to acheive?
IPS detection of local LAN events?
I'm not sure that's possible; the IPS does not run in promiscuous mode on the UTM.

Even if it did, you'd overload the CPU in the UTM.

For that purpose, you should build a separate IDS box.

Barry
Cancel
Vote Up 0 Vote Down

Cancel
0 s0ke over 11 years ago in reply to BarryG

IPS detection of local LAN events?
Yes

I was hoping I could take advantage of Snort and sniff my LAN as well with an additional card. Sounds like I will need to build another machine. Thanks for the quick reply.
Cancel
Vote Up 0 Vote Down

Cancel
0 BarryG over 11 years ago

SecurityOnion looks promising, btw.

Barry
Cancel
Vote Up 0 Vote Down

Cancel
0 s0ke over 11 years ago in reply to BarryG

I ended up upgrading my switch to a Netgear GS108T and setting up a SPAN port. Added a 2nd NIC to my deb box and went with Snort/Snorby.
Cancel
Vote Up 0 Vote Down

Cancel