From owner-freebsd-security@FreeBSD.ORG  Sat Dec 20 16:28:19 2003
Return-Path: <owner-freebsd-security@FreeBSD.ORG>
Delivered-To: freebsd-security@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id E189116A4CE
	for <freebsd-security@freebsd.org>;
	Sat, 20 Dec 2003 16:28:19 -0800 (PST)
Received: from web60806.mail.yahoo.com (web60806.mail.yahoo.com
	[216.155.196.69])
	by mx1.FreeBSD.org (Postfix) with SMTP id 2538E43D60
	for <freebsd-security@freebsd.org>;
	Sat, 20 Dec 2003 16:28:15 -0800 (PST)
	(envelope-from richard_bejtlich@yahoo.com)
Message-ID: <20031221002814.39893.qmail@web60806.mail.yahoo.com>
Received: from [68.84.6.72] by web60806.mail.yahoo.com via HTTP;
	Sat, 20 Dec 2003 16:28:14 PST
Date: Sat, 20 Dec 2003 16:28:14 -0800 (PST)
From: Richard Bejtlich <richard_bejtlich@yahoo.com>
To: freebsd-security@freebsd.org
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Subject: Re: interface bonding
X-BeenThere: freebsd-security@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Security issues [members-only posting]
	<freebsd-security.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>,
	<mailto:freebsd-security-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-security>
List-Post: <mailto:freebsd-security@freebsd.org>
List-Help: <mailto:freebsd-security-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>,
	<mailto:freebsd-security-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Sun, 21 Dec 2003 00:28:20 -0000

Hello,

I operate http://taosecurity.blogspot.com and
http://www.taosecurity.com.

I posted a method to use ng_one2many for bonding
interfaces here in June:

http://marc.theaimsgroup.com/?l=snort-users&m=105585533810122&w=2

That method relies on three real interfaces: the two
to be bonded and a third against which traffic is
mirrored.

I've not had luck creating a third "virtual" interface
against which to sniff.

Using ng_fec, however, a fec0 interface us created
automatically.  That's what I'm using now on my NSM
sensor and it works fine.

I appreciate any hints on creating a virtual interface
to use for sniffing with ng_one2many.   If you can
help me do that I'll use ng_one2many instead of
ng_fec.  ng_fec doesn't have a man page, which is
enough for me to avoid it if possible.  :)

Thank you,

Richard
http://www.taosecurity.com



__________________________________
Do you Yahoo!?
Free Pop-Up Blocker - Get it now
http://companion.yahoo.com/