This is Interesting: Free IT Magazines  
Home > Archive > Snort > September 2004 > [Snort-users] Snorting MS PPTP VPN





You are viewing an archived Text-only version of the thread. To view this thread in it's original format and/or if you want to reply to this thread please [click here]

Author [Snort-users] Snorting MS PPTP VPN
Lyndon Tiu

2004-09-22, 10:25 pm

Question:



Is it possible to snort what goes through a MS PPTP VPN? I suspect viruses are going through the VPN from one office site to another but can snort help here?



What info, if any can we get from this setup?



Thanks for any tips.



--

Lyndon Tiu


-------------------------------------------------------
This SF.Net email is sponsored by: YOU BE THE JUDGE. Be one of 170
Project Admins to receive an Apple iPod Mini FREE for your judgement on
who ports your project to Linux PPC the best. Sponsored by IBM.
Deadline: Sept. 24. Go here: http://sf.net/ppc_contest.php
________________________________________
_______
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists...nfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf....ist=snort-users
Matt Kettler

2004-09-22, 10:25 pm

At 01:33 PM 9/17/2004, Lyndon Tiu wrote:
>Is it possible to snort what goes through a MS PPTP VPN? I suspect viruses
>are going through the VPN from one office site to another but can snort
>help here?


Snort won't be able to decode what's inside your VPN.. If it could, your
VPN would be pointless... Remember, the point of a VPN is to prevent people
from knowing what's going through it.


Now, you could insert a snort sensor some place behind your firewall to see
all the traffic after it's been decrypted.. Couple that with some rules
from bleedingsnort and you could detect this kind of thing, but you're
going to have to snort it before it enters the VPN tunnel.



-------------------------------------------------------
This SF.Net email is sponsored by: YOU BE THE JUDGE. Be one of 170
Project Admins to receive an Apple iPod Mini FREE for your judgement on
who ports your project to Linux PPC the best. Sponsored by IBM.
Deadline: Sept. 24. Go here: http://sf.net/ppc_contest.php
________________________________________
_______
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists...nfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf....ist=snort-users
Sponsored Links






Free braindumps | Software forum | Database administration forum

Copyright 2003 - 2010 webservertalk.com