All of lore.kernel.org
 help / color / mirror / Atom feed
From: "Hans-Cees Speel" <hanscees@myrealbox.com>
To: lartc@vger.kernel.org
Subject: [LARTC] is packet duplicating possible for ids?
Date: Tue, 12 Mar 2002 10:19:40 +0000	[thread overview]
Message-ID: <marc-lartc-101592820113967@msgid-missing> (raw)

Hi,
I am a newbie to this all (advanced routing) but would like to know
more :-)

I have a situation where I would like to use tc or any tool to send
all incoming (and perhaps outgoing) traffic not only to itsd
destination but also past a ids snort box. The trouble is that my
external interface to the internet is a pptp connection (ask my
provider why) and thus the ppp0 device. This device is located on a
linuxbox where a pptp connection is made to a adsl modem. The 
gateway
masqeurades then to the internal private network. Normally I would 
set
up the ids on a hub between the gateway and the  modem, but 
since the
connection goes over pptp snort can't see traffic. I do not want to
make the gateway ids, because it is an old machine also web-
serving.

So I am wondering if I can somehow create something equal to a 
sniffer port on a switch and send all traffic comning in/out of ppp0
to an internal ip adress (where snort is).

hope you can help me

hc
Theories come and go, the frog stays [F. Jacob]      
-------------------------------------------------------
Hans-Cees Speel http://www.hanscees.com
pgp public key at http://www.hanscees.com/hcs.asc

Editor "Journal of Memetics Evolutionary Models of Information 
Transmission"
http://www.cpm.mmu.ac.uk/jom-emit
submit papers to the new managing editors at
w.m.dejong@tbm.tudelft.nl or mikeb@media.mit.edu

_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/

                 reply	other threads:[~2002-03-12 10:19 UTC|newest]

Thread overview: [no followups] expand[flat|nested]  mbox.gz  Atom feed

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=marc-lartc-101592820113967@msgid-missing \
    --to=hanscees@myrealbox.com \
    --cc=lartc@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.