Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have just installed Security Onion distro based on ubuntu. This distro does a great job of combining multiple tools like snort/suricata,sguil,snorby,elsa,bro ids,squert. In my Security Onion installation interface has been port mirrored. But all the alerts I have seen are from source IP of our local network, both private and public. I could see outside ip's in elsa or squert pads data, but not in the snorby alerts. seems little strange to me, as there has been a known dos attempt wid an outside ip. My bpf also not stopping any outside ip as well. Wondering possible reasons for such behaviour .

cat /etc/nsm/rules/bpf.conf !(dst portrange 11000-65000) && !(src net 10.20.30.0/23) && !(src net 208.80.43.131)&& !(src net 208.80.43.39)

share|improve this question
    
I can probably answer this for you if you provide a small diagram and your IP scheme. Do you NAT both ways? Where is the sensor located in your architecture? –  dc5553 May 12 '13 at 8:46

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.