March 2008 Archives
Last week Bamm has made Sguil version 0.7.0 final and released it on Sguil website.
Big changes are separation of agents, (resp. snort_agent, pcap_agent and sancp_agent), added Passive Asset Detection System (PADS) agent and a lot of bug fixes.
For those who aren't familiar with Sguil, check the Sguil website or the overview on Sguil Wiki page.
When I can find the time, I will post my article about 'Network Security Monitoring in a multi tiered environment'.
When you are using a Network TAP (e.g. NetOptics), and want to bond the interfaces on a FreeBSD, then you have a new way to do this.
Since FreeBSD 6.3 they have introduced a new device called lagg(4). Lagg is a link aggregation and link failover interface.
With lagg you can easily bond two interfaces together.
# ifconfig lagg0 create
# ifconfig lagg0 laggproto fec laggport bge0 laggport bge1 monitor up
Default it uses failover protocol, which you don’t want to use when bonding interfaces. The best protocol for this would be Cisco EtherChannel.
