<!DOCTYPE html PUBLIC '-//W3C//DTD HTML 4.01 Transitional//EN'>
<html><head><meta http-equiv="Content-Type" content="text/html;charset=us-ascii">
<style>BODY{font:10pt Tahoma,Verdana,sans-serif} .MsoNormal{line-height:120%;margin:0}</style></head><body>
<DIV>Inline from ISP router to one port on appliance out another port directly to WAN connection of firewall.</DIV>
<DIV> </DIV>
<DIV>When using AF-Packet, not using brctl bridging because that doubles the data going through interfaces. But when just using IDS mode, we use brctl bridging method.</DIV>
<DIV> </DIV>
<DIV>We did notice during testing that we get a few more event. We tested with a vulnerability scanning PC on one port and the other port directly into internal network. There was one SCAN event that appeared in log during a Nmap scan. Would have thought we would have seen more.</DIV>
<DIV> </DIV>Thanks.<BR><BR>Leonard
<BLOCKQUOTE style="PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #0000ff 2px solid; MARGIN-RIGHT: 0px">
<HR>
<B>rom:</B> Matt Jonkman [mailto:jonkman@jonkmans.com]<BR><B>To:</B> Leonard Jacobs [mailto:ljacobs@netsecuris.com]<BR><B>Cc:</B> oisf-users@openinfosecfoundation.org, Eric Leblond [mailto:eric.leblond@gmail.com]<BR><B>Sent:</B> Mon, 01 Apr 2013 12:31:44 -0600<BR><B>Subject:</B> Re: [Oisf-users] Question<BR><BR>
<DIV>Are you sure the box is seeing all traffic? Is it inline, or on a tap, etc?
<DIV><BR></DIV>
<DIV>Matt</DIV></DIV>
<DIV class=gmail_extra><BR><BR>
<DIV class=gmail_quote>On Sat, Mar 30, 2013 at 11:14 AM, Leonard Jacobs <SPAN><<A href="mailto:ljacobs@netsecuris.com">ljacobs@netsecuris.com</A>></SPAN> wrote:<BR>
<BLOCKQUOTE class=gmail_quote style="PADDING-LEFT: 1ex; MARGIN: 0px 0px 0px 0.8ex; BORDER-LEFT: #ccc 1px solid">
<DIV>
<DIV>
<P class=MsoNormal><SPAN style="FONT-SIZE: 11pt; FONT-FAMILY: 'Calibri', 'sans-serif'; COLOR: #1f497d">The only event I am getting is ET POLICY Unusual number of DNS No Such Name Responses.<U></U><U></U></SPAN></P>
<DIV class=im>
<P class=MsoNormal><SPAN style="FONT-SIZE: 11pt; FONT-FAMILY: 'Calibri', 'sans-serif'; COLOR: #1f497d"><U></U><U></U></SPAN> </P>
<P class=MsoNormal><B><SPAN style="FONT-SIZE: 10pt; FONT-FAMILY: 'Tahoma', 'sans-serif'">From:</SPAN></B><SPAN style="FONT-SIZE: 10pt; FONT-FAMILY: 'Tahoma', 'sans-serif'"> <A href="mailto:mjonkman@emergingthreatspro.com">mjonkman@emergingthreatspro.com</A> [mailto:<A href="mailto:mjonkman@emergingthreatspro.com">mjonkman@emergingthreatspro.com</A>] <B>On Behalf Of </B>Matt Jonkman<BR><B>Sent:</B> Saturday, March 30, 2013 8:40 AM<BR><B>To:</B> Leonard Jacobs<BR><B>Cc:</B> <A href="mailto:oisf-users@openinfosecfoundation.org">oisf-users@openinfosecfoundation.org</A>; Eric Leblond<BR><B>Subject:</B> Re: [Oisf-users] Question<U></U><U></U></SPAN></P>
<P class=MsoNormal><U></U><U></U> </P></DIV>
<DIV>
<P class=MsoNormal>Definitely should have. What rules are you running? Just the ET Open?<U></U><U></U></P>
<DIV>
<DIV class=h5>
<DIV>
<P class=MsoNormal><U></U><U></U> </P></DIV>
<DIV>
<P class=MsoNormal>Have your vars set right?<U></U><U></U></P></DIV>
<DIV>
<P class=MsoNormal><U></U><U></U> </P></DIV>
<DIV>
<P class=MsoNormal>Are you seeing other events?<U></U><U></U></P></DIV>
<DIV>
<P class=MsoNormal><U></U><U></U> </P></DIV>
<DIV>
<P class=MsoNormal>Matt<U></U><U></U></P></DIV></DIV></DIV></DIV>
<DIV>
<DIV class=h5>
<DIV>
<P class=MsoNormal style="MARGIN-BOTTOM: 12pt"><U></U><U></U> </P>
<DIV>
<P class=MsoNormal>On Fri, Mar 29, 2013 at 5:04 PM, Leonard Jacobs <<A href="mailto:ljacobs@netsecuris.com">ljacobs@netsecuris.com</A>> wrote:<U></U><U></U></P>
<DIV>
<DIV>
<P class=MsoNormal>Why would Suricata events not be triggered when running a vulnerability scanner? I ran OpenVAS against a couple of public IP addresses on our network and not a single event was triggered. I would have thought that at least emerging-scan.rules would trigger.<U></U><U></U></P>
<P class=MsoNormal><U></U><U></U> </P>
<P class=MsoNormal>Thanks.<U></U><U></U></P>
<P class=MsoNormal><U></U><U></U> </P>
<P class=MsoNormal><SPAN style="FONT-FAMILY: 'Arial', 'sans-serif'">Leonard Jacobs</SPAN><U></U><U></U></P>
<P class=MsoNormal><SPAN style="FONT-FAMILY: 'Arial', 'sans-serif'">President/CEO</SPAN><U></U><U></U></P>
<P class=MsoNormal><SPAN style="FONT-FAMILY: 'Arial', 'sans-serif'">Netsecuris Inc.</SPAN><U></U><U></U></P>
<P class=MsoNormal><SPAN style="FONT-FAMILY: 'Arial', 'sans-serif'">9301 Bryant Avenue S</SPAN><U></U><U></U></P>
<P class=MsoNormal><SPAN style="FONT-FAMILY: 'Arial', 'sans-serif'">Suite 104</SPAN><U></U><U></U></P>
<P class=MsoNormal><SPAN style="FONT-FAMILY: 'Arial', 'sans-serif'">Minneapolis, MN 55420</SPAN><U></U><U></U></P>
<P class=MsoNormal><SPAN style="FONT-FAMILY: 'Arial', 'sans-serif'"><A href="tel:%28952%29%20641-1421%20ext.%2020">(952) 641-1421 ext. 20</A></SPAN><U></U><U></U></P>
<P class=MsoNormal><SPAN style="FONT-FAMILY: 'Arial', 'sans-serif'"></SPAN><U></U><U></U> </P>
<P class=MsoNormal><SPAN style="FONT-FAMILY: 'Arial', 'sans-serif'"><A href="http://www.netsecuris.com">http://www.netsecuris.com</A></SPAN><U></U><U></U></P>
<P class=MsoNormal><SPAN style="FONT-FAMILY: 'Arial', 'sans-serif'"></SPAN><U></U><U></U> </P>
<P class=MsoNormal><SPAN style="FONT-FAMILY: 'Arial', 'sans-serif'"></SPAN><U></U><U></U></P>
<P class=MsoNormal><SPAN style="FONT-FAMILY: 'Arial', 'sans-serif'"></SPAN><U></U><U></U> </P>
<P class=MsoNormal><U></U><U></U> </P></DIV></DIV>
<P class=MsoNormal><BR>_______________________________________________<BR>Suricata IDS Users mailing list: <A href="mailto:oisf-users@openinfosecfoundation.org">oisf-users@openinfosecfoundation.org</A><BR>Site: <A href="http://suricata-ids.org">http://suricata-ids.org</A> | Support: <A href="http://suricata-ids.org/support/">http://suricata-ids.org/support/</A><BR>List: <A href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users">https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</A><BR>OISF: <A href="http://www.openinfosecfoundation.org/">http://www.openinfosecfoundation.org/</A><U></U><U></U></P></DIV>
<P class=MsoNormal><BR><BR clear=all><U></U><U></U></P>
<DIV>
<P class=MsoNormal><U></U><U></U> </P></DIV>
<P class=MsoNormal>-- <BR><BR><BR>----------------------------------------------------<BR>Matt Jonkman<BR>Emerging Threats Pro<BR>Open Information Security Foundation (OISF)<BR>Phone <A href="tel:866-504-2523%20x110">866-504-2523 x110</A><BR><A href="http://www.emergingthreatspro.com">http://www.emergingthreatspro.com</A><BR><A href="http://www.openinfosecfoundation.org">http://www.openinfosecfoundation.org</A><BR>---------------------------------------------------- <U></U><U></U></P></DIV></DIV></DIV></DIV></DIV><BR>_______________________________________________<BR>Suricata IDS Users mailing list: <A href="mailto:oisf-users@openinfosecfoundation.org">oisf-users@openinfosecfoundation.org</A><BR>Site: <A href="http://suricata-ids.org">http://suricata-ids.org</A> | Support: <A href="http://suricata-ids.org/support/">http://suricata-ids.org/support/</A><BR>List: <A href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users">https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</A><BR>OISF: <A href="http://www.openinfosecfoundation.org/">http://www.openinfosecfoundation.org/</A><BR></BLOCKQUOTE></DIV><BR><BR clear=all>
<DIV><BR></DIV>-- <BR><BR><BR>----------------------------------------------------<BR>Matt Jonkman<BR>Emerging Threats Pro<BR>Open Information Security Foundation (OISF)<BR>Phone 866-504-2523 x110<BR><A href="http://www.emergingthreatspro.com">http://www.emergingthreatspro.com</A><BR><A href="http://www.openinfosecfoundation.org">http://www.openinfosecfoundation.org</A><BR>---------------------------------------------------- </DIV></BLOCKQUOTE>
<STYLE>
</STYLE>
<DIV> </DIV>
<DIV> </DIV></body></html>