<html><body><div style="font-family: Andale Mono; font-size: 12pt; color: #000000"><div>About the detection capability, we really have a problem. Today, we have nothing, so, if better than nothing. Of course, we are looking for the best solution with our resources.<br></div><div><br data-mce-bogus="1"></div><div>Until next weeks i'll do some test e put the results here :)</div><div><br data-mce-bogus="1"></div><div>Thanks</div><div><br data-mce-bogus="1"></div><div>Best Regards,</div><div><br></div><div data-marker="__SIG_PRE__">-----------------------------------------------<br>Alan Santos<br>Analista de Segurança<br>Centro de Atendimento a Incidentes de Segurança (CAIS)<br>Rede Nacional de Ensino e Pesquisa (RNP)<br>(19) 3787-3314 | alan.santos@rnp.br</div><br><hr id="zwchr" data-marker="__DIVIDER__"><div data-marker="__HEADERS__"><b>De: </b>"Andreas Moe" <moe.andreas@gmail.com><br><b>Para: </b>"oisf-users" <oisf-users@openinfosecfoundation.org><br><b>Enviadas: </b>Terça-feira, 1 de setembro de 2015 2:15:14<br><b>Assunto: </b>Re: [Oisf-users] Working with mirror sampling<br></div><br><div data-marker="__QUOTED_TEXT__"><p dir="ltr">Just thinking out loud here. But from a security standpoint (and for example if i was the manager / customer of this network), i would not at all be comfertable with your detection capability if you are only sampling the network traffic. Looking at so few events will make you see only a fraction of incidents, and so on.</p>
<p dir="ltr">If this is "all you can get", then it is better than nothing, but i would advise you to revisit your hardware limitations.</p>
<p dir="ltr">When it comes to running suricata from a mirror sample, i think you would meet alot of issues. Missing ACKs, incomplete sessions, random resets, and so on. Sampling is much more usefull, and intended for netflow analysis.</p>
<p dir="ltr">But then again, it would be cool to hear and see your resultat :)</p>
<br><div class="gmail_quote"><div dir="ltr">---------- Forwarded message ---------<br>From: Alan Wanderley dos Santos <<a href="mailto:alan.santos@rnp.br" target="_blank">alan.santos@rnp.br</a>><br>Date: man. 31. aug. 2015, 22.43<br>Subject: [Oisf-users] Working with mirror sampling<br>To: <<a href="mailto:oisf-users@openinfosecfoundation.org" target="_blank">oisf-users@openinfosecfoundation.org</a>><br></div><br><br>Hi all,<br>
<br>
I'll use suricata in a backbone with a large amount of data. I'm thinking in put suricata at each aggregation router (5 - 20 Gbps for each router). My problem is the hardware and software limitation. To solve this, i'll use mirror by sampling. JUNOS support this feature. For do that, a denominator will be used (not defined yet). Maybe 1/1000 or 1/2000, i don't know.<br>
<br>
Other option, for a better coverage, i'll test mirror only the first 120 bytes that each packet (i don't need that all 1500 bytes of packet for identify a new).<br>
<br>
So, the questions are:<br>
<br>
Does someone uses suricata with in mirror sampling mode? It's works?<br>
<br>
Does anyone have experience with mirror parts of a packet (first $x bytes)?<br>
<br>
Best Regards,<br>
<br>
att,<br>
<br>
<br>
-----------------------------------------------<br>
Alan Santos<br>
Analista de Segurança<br>
Centro de Atendimento a Incidentes de Segurança (CAIS)<br>
Rede Nacional de Ensino e Pesquisa (RNP)<br>
(19) 3787-3314 | <a href="mailto:alan.santos@rnp.br" target="_blank">alan.santos@rnp.br</a><br>
_______________________________________________<br>
Suricata IDS Users mailing list: <a href="mailto:oisf-users@openinfosecfoundation.org" target="_blank">oisf-users@openinfosecfoundation.org</a><br>
Site: <a href="http://suricata-ids.org" rel="noreferrer" target="_blank">http://suricata-ids.org</a> | Support: <a href="http://suricata-ids.org/support/" rel="noreferrer" target="_blank">http://suricata-ids.org/support/</a><br>
List: <a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users" rel="noreferrer" target="_blank">https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a><br>
Suricata User Conference November 4 & 5 in Barcelona: <a href="http://oisfevents.net" rel="noreferrer" target="_blank">http://oisfevents.net</a><br>
</div>
<br>_______________________________________________<br>Suricata IDS Users mailing list: oisf-users@openinfosecfoundation.org<br>Site: http://suricata-ids.org | Support: http://suricata-ids.org/support/<br>List: https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users<br>Suricata User Conference November 4 & 5 in Barcelona: http://oisfevents.net<br></div></div></body></html>