Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a snort sensor monitoring some of my network being fed from a mirrored port. This mirrored session only monitors traffic between the firewall and peering switch. Since this just sees traffic enter/exiting our network we miss a lot of internally routed traffic. What useful places on the inside of our network should I be looking at to place more snort sensors?

share|improve this question
Let's go for more paranoia than not. – k to the z Jul 26 '12 at 18:28
up vote 7 down vote accepted

Sensor placement can be very tricky as there are loads of variables to consider. At minimum, you should take into account

  • Classification level of monitored resource
  • Network design
  • System throughput
  • Personnel time (for management and analysis)
  • Resource availability

Throwing all of those into a blender and turning on high for a few minutes will give you some nice data to start with for determining your deployment. Deployment planning is a multiphase process, and while they are not intrinsically separated, it is beneficial to remember that they are different parts of the same plan.

Data Collection and Planning

More likely than not, what you're going to want to do is construct a list of all of the systems that you want to monitor, then rate them based on importance or risk. That should give you a prioritization of what systems you really need to be watching now. In a perfect world, we would have a sensor monitoring the link connected to each and every system. However, that would be scary expensive, difficult to maintain, and noisy. Instead, talk to your network team and take a good hard look at your network design. Figure out on the network map where your prioritized systems live and figure out where the choke points are. Look at what hardware you have available to turn into sensors. In an awesome environment, you could have one big box with a few 10Gbps interfaces and do all of your monitoring for an entire enterprise using a single sensor. However, more likely, you're going to have a few surplus systems that used to be used by department secretaries and will need to spread the load.

Array Design and Deployment

Now is the time to think long and hard about what risk acceptance threshold is. How close to the sensitive data do you feel like you need to have a sensor, and how far away do you feel comfortable placing it? In some cases you may really need to monitor the switch port that a server is directly connected to. In other cases placing a single sensor on a building or floor uplink, and ignoring any intra-switch traffic, is sufficient. In another case you may feel as if mirroring a specific port is not good enough, and instead mirror an entire VLAN.

Workload and Other Considerations

As you're building our your sensor deployment strategy keep in mind that it can get very complicated. As you decide where to place your sensors, make sure to account for all of the other issues that arise. For every sensor you deploy there will be management overhead for an employee to actually maintain the system (apply patches, hardware replacement, etc), application management overhead (updating signatures, tweaking rulesets, making sure snortd stays running), and analyst time (interpreting the alerts and taking action). Depending on your design, and how much time you're willing to front-load, these numbers can vary wildly. For example, using the right configuration management/automation tools, it's not that difficult to manage several dozen snort sensors using a fraction of an FTE.

share|improve this answer
Thank you for the detailed response. – k to the z Jul 26 '12 at 19:39
@ktothez: You've ended up asking an exceptionally broad question whether you meant to or not. As you go through the process pop up other, more specific, questions that you run into. Don't get discouraged, I have some of my most fun when doing sensor installs! – Scott Pack Jul 27 '12 at 12:46
I guess it was pretty broad. Thank you though. I'll ask if I run into something. – k to the z Jul 27 '12 at 14:19

If you have Cisco networking equipment you can use Catalyst Switched Port Analyzer (SPAN) to mirror traffic from a port to another one which you have your snort sensor on.

Their is a Cisco SPAN Configuration example at

Other networking equipment has similar capabilities.

We use this to mirror all outbound and inbound traffic on our network without inserting a device in the flow.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.