| Matt Kettler 2004-09-22, 10:25 pm |
| At 01:33 PM 9/17/2004, Lyndon Tiu wrote:
>Is it possible to snort what goes through a MS PPTP VPN? I suspect viruses
>are going through the VPN from one office site to another but can snort
>help here?
Snort won't be able to decode what's inside your VPN.. If it could, your
VPN would be pointless... Remember, the point of a VPN is to prevent people
from knowing what's going through it.
Now, you could insert a snort sensor some place behind your firewall to see
all the traffic after it's been decrypted.. Couple that with some rules
from bleedingsnort and you could detect this kind of thing, but you're
going to have to snort it before it enters the VPN tunnel.
-------------------------------------------------------
This SF.Net email is sponsored by: YOU BE THE JUDGE. Be one of 170
Project Admins to receive an Apple iPod Mini FREE for your judgement on
who ports your project to Linux PPC the best. Sponsored by IBM.
Deadline: Sept. 24. Go here: http://sf.net/ppc_contest.php
________________________________________
_______
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists...nfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf....ist=snort-users
|