2

Here's what I want to do:

I want to use a VPN client on my PC (like TunnelBear). Then I want to use Snort to sniff traffic before it's encrypted and after it's decrypted by VPN.

So basically I want Snort to sit between my OS and the VPN. So Snort should sniff outgoing traffic before it's encrypted by VPN and should sniff incoming traffic after it's decrypted by VPN.

How can I do this?

Improve this question
3
  • I flagged it to be moved to serverfault, so hopefully it will be migrated there soon. You don't need to do anything. Serverfault is the site for system administratin (= setting programs up). Alternatively delete this one and make a new one there.
    – Peter Harmann
    Sep 19, 2018 at 18:56
  • @PeterHarmann "Server Fault is a question and answer site for managing information technology systems in a business environment." serverfault.com/tour
    – schroeder ♦
    Sep 19, 2018 at 19:07
  • 4
    A real VPN provides a virtual network interface (i.e. something like tun0 etc - actual name might differ) which receives the plain traffic from the local host and encrypts and and also returns the decrypted traffic to the local host. You can let snort simply sniff on this interface the same as it would otherwise sniff on the physical network interface (i.e. snort -i tun0).
    – Steffen Ullrich
    Sep 19, 2018 at 19:08

1 Answer 1

Reset to default
0

Steffen Ullrich has the correct answer. Snort is a program on your computer. The program looks at traffic on a network interface. The traffic is 'exiting' at your machine, from the VPN. The Snort program can see this traffic as it exits, as it has been decrypted. The command that Steffen posted is telling snort to look at traffic on an interface called 'tun0'. The interface may otherwise be named 'tap0' or similar, depending on VPN used.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .