TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message to
[EMAIL PROTECTED] Contact [EMAIL PROTECTED] for help with any problems!
----------------------------------------------------------------------------
Yeah we *always* plug the span port on the switches (when working on
switches) into at least a 100/10 4 port hub so we can interface
additional maintenance devices onto a span port. Such as several
laptops so we can sniff the traffic going to RS etc etc.
Jared Tabb wrote:
>
> The sniffer interface does send the tcp resets. According to ISS, it
> temporarily binds a protocol to send the resets. It does not send the
> resets from the stealth interface. Because of this you must make sure that
> the sniffer interface is connected to a bi-directional device so it can
> receive and send. This makes it real hard to use an ethernet tap since they
> are uni-directional. I recommend using a 100mb/s hub.
>
> Jared
>
> -----Original Message-----
> From: George Milliken [mailto:[EMAIL PROTECTED]]
> Sent: Wednesday, August 02, 2000 4:57 PM
> To: Mark S. Velasquez
> Cc: [EMAIL PROTECTED]
> Subject: Re: **RealSecure 5.0 & E-Mail Alerts**
>
> TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message to
> [EMAIL PROTECTED] Contact [EMAIL PROTECTED] for help with any
> problems!
> ----------------------------------------------------------------------------
>
> For that matter, how do TCP RS KILLs happen across the "secure" stealth
> interface?
>
> We have puzzled on this much recently. We assume the emails go out
> over the internal interface but I have not verified that via sniffer.
>
> But, how do the resets happen??? There is not guarentee that the
> internal interface can route packets back to the stealth (outside) side
> of the network.
>
> Anybody got a clue?
>
> "Mark S. Velasquez" wrote:
> >
> > TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message
> to
> > [EMAIL PROTECTED] Contact [EMAIL PROTECTED] for help with any
> problems!
> >
> ----------------------------------------------------------------------------
> >
> > I've installed RealSecure 5.0. The Network Sensors are installed on
> > Sparc Solaris 7.0 platforms with the monitoring interface in stealth
> > mode( no IP assigned to it, no arp, etc.), and a second interface on a
> > private Network to the monitoring Console.
> >
> > My question concerns E-Mail Responses. I'd assumed that the monitoring
> > console sent them. From reading the manual it appears that the Network
> > Sensor sends them...if so how is this supposed to work in a secure
> > setup( it cant' send via the stealth-configured interface... and the
> > other interface connects directly to the Monitoring Console. ).
> >
> > How is everyone else sending E-Mail responses/alerts in a secure
> > configuration ?
> >
> > TIA
> >
> > Mark
>
> --
>
> Regards,
>
> George Milliken
>
> ---------------------------------
> farm9, Inc.
>
> Online Intrusion Prevention 24x7
> http://www.farm9.com
> ---------------------------------
--
Regards,
George Milliken
---------------------------------
farm9, Inc.
Online Intrusion Prevention 24x7
http://www.farm9.com
---------------------------------
