Replace Switch with Firewall - Is there some auto-learnign tool forfirewall requirements?

[Nicolas Valcarcel]

But, doing that aren't you going to have a linux-bridge with a nonsense
firewall? IMHO that will result on something that wouldn't work as security.
If you make that some application hears the connections and then creates
firewall rules based on that the result will be an wide-open-firewall
permitting almost everything and that's unuseful, it will be better make a
sniffing (using ethereal, dsniff or some other sniffer) and then go user by
user asking him what's his use of the network and then decide (analyzing
what will be permitted) what to open and what to close.

On Nov 15, 2007 3:44 AM, Haas, Gisbert <ghaas at ibahn.com> wrote:

> I would simply use NTOP or Ethereal to get an idea whats going on. With
> Ethereal you can put filters so you not capture all traffic.
>
> -----Original Message-----
> From: ubuntu-server-bounces at lists.ubuntu.com
> [mailto:ubuntu-server-bounces at lists.ubuntu.com] On Behalf Of
> ml at bortal.de
> Sent: Thursday, November 15, 2007 9:42 AM
> To: ubuntu-server at lists.ubuntu.com
> Subject: Replace Switch with Firewall - Is there some auto-learnign tool
> forfirewall requirements?
>
> Hello List,
>
> right now we have a "flat"-network (one subnet):
> 192.168.0.1-100 and 192.168.0.101-254
>
> Those two Network segments are connected by a bridged linux box. Not
> filtering at this point. Its just a switch really.
>
> Now we would like to keep the "flat"-network for some good reasons and
> replace the linux-bridge with a bridged firewall (physdev match).
>
> Since i dont want to break the network with its functionality i thought
> of capturing the current traffic for some time and check out the IPs,
> Ports, etc... which are beeing used.
> Like the learning mode grsecurity has.  ( i acutally find this a very
> cool idea! ;-) )
>
> Based on the captured information i would like to create my firewall
> rule with firewallbuilder.
> I know i have to check out the captured rules well to make sure i dont
> implement a hole in my firewall setup!
>
> Is there a way or project to capture my firewall requirements? I guess i
>
> basically need all SYN-Flags and its DEST-Ports?
> How can i get them easily out the the massive traffic each day? Do you
> need more infos?
>
> Any ideas are welcome!
>
> Thanks, Mario
>
>
> --
> ubuntu-server mailing list
> ubuntu-server at lists.ubuntu.com
> https://lists.ubuntu.com/mailman/listinfo/ubuntu-server
> More info: https://wiki.ubuntu.com/ServerTeam
>
> --
> ubuntu-server mailing list
> ubuntu-server at lists.ubuntu.com
> https://lists.ubuntu.com/mailman/listinfo/ubuntu-server
> More info: https://wiki.ubuntu.com/ServerTeam
>



-- 
aka nxvl
Yo uso Software Libre, y tu?
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.ubuntu.com/archives/ubuntu-server/attachments/20071116/56a8b8cc/attachment.html>