[Oisf-users] Suricata - Reject in one-arm IPS/IDS mode

[Victor Julien]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 03/23/2015 08:09 PM, Rovnov Pavel wrote:
> Hello Coop, Anthony,
> 
> I don't control neither users nor web servers. So I can't instruct
> users to use proxy or run all web applications through
> reverse-proxy.
> 
> Inline mode is not acceptable in my scenario (let me say the guy
> who owns infrastructure doesn't allow me to be inline).
> 
> What I can is to use mirrored traffic to do my analysis. So the
> question remains the same:
> 
> 1)	Can I use reject when out-of-band?

Yeah.

> 2)	How can I specify interface to send rejects from? I can't use 
> 2-way SPAN port on my switch.

Not sure here. I think you'd need another nic thats on your switch. We
use libnet, not sure how it selects the nic to use. Might use the nic
that has a valid route to the destination? Think you'll need to
experiment here.

Cheers,
Victor


> 
> Thanks!
> 
> -----Original Message----- From: Cooper F. Nelson
> [mailto:cnelson at ucsd.edu] Sent: Monday, March 23, 2015 9:59 PM To:
> Rodgers, Anthony (DTMB); Rovnov Pavel; 
> oisf-users at lists.openinfosecfoundation.org Subject: Re:
> [Oisf-users] Suricata - Reject in one-arm IPS/IDS mode
> 
> +1 to using a web proxy.  Squid is free.
> 
> You can even run suricata inline on a squid proxy and create a
> robust, next-generation proxy-firewall with Layer-7 intrusion 
> detection/prevention.
> 
> -Coop
> 
> On 3/23/2015 9:17 AM, Rodgers, Anthony (DTMB) wrote:
>> Why not use a web proxy like squid for this?
> 
> 
> 
>> --
> 
>> Anthony Rodgers
> 
>> Security Analyst
> 
>> Michigan Security Operations Center (MiSOC)
> 
>> DTMB, Michigan Cyber Security
> 
> 
> _______________________________________________ Suricata IDS Users
> mailing list: oisf-users at openinfosecfoundation.org Site:
> http://suricata-ids.org | Support:
> http://suricata-ids.org/support/ List:
> https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users
>
> 
Training now available: http://suricata-ids.org/training/
> 

- -- 
- ---------------------------------------------
Victor Julien
http://www.inliniac.net/
PGP: http://www.inliniac.net/victorjulien.asc
- ---------------------------------------------

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQEcBAEBAgAGBQJVFTXIAAoJEMH0leOSaFa0mO8H/05kirfk52HYTIOwVmqFytqG
XseeP3BYaLPL6W/f9/+XCU+gqpZn+BbaBG3znot1pXKeEAuNrVzjrT228ASpbIsV
6ymTBuyOwgTXYvofW47sCEpRlcc5fukAqWYTxmmrLQJpfMMjUfq9v74IqJBeL0x2
Cu9VHICY9RxDyYUBYSakGX4DeVmTIYNdEYw5qe0jdw+2Ikv4v27ef1Sm5cpknKLG
AWGeflIEiQWWuMkRxw1HMMdbc3mmniA3tbzuktvp88o6vsKBlgoa45SsX0EvfjeL
rn5Q7q46ehOblJp+94pfHC20dbZUGmcO7Ax9VFGhDeeuxn1baPahuTcuoRsuyz4=
=YRJv
-----END PGP SIGNATURE-----