4

Can a Cisco router act as an IDS for LAN traffic that does not pass through it? Specifically, can traffic passing through a switch be port mirrored to an interface on the router with the router acting as an IDS?

I am looking for a way to use an ISR G2 router like Snort to monitor traffic between devices on a LAN.

Improve this question
1
  • what model/ feature set do you have? regardless i don't think there is anything that will work exactly like you think that it may work.
    – John Kennedy
    Nov 25, 2013 at 16:14

3 Answers 3

Reset to default
2

I am looking for a way to use an ISR G2 router like Snort [snip]

Your entire question starts and stops right there. The IPS/IDS within IOS is not designed for out-of-band traffic inspection. The router must be inline to inspect it.

Put simply, IOS is not SNORT. If you want SNORT, run SNORT.

(Also, the IPS/IDS within IOS is very slow -- being done entirely in the way under powered router CPU -- and often incomplete. You'll need a support contract to keep it remotely up to date.)

Improve this answer
3

No,

But what you CAN do is set up a box with SNORT.

Or you can apply an access-list to your Span session port that is just "permit ip any any log" and that will log traffic source and destination addresses (along with TCP/UDP port info). Then if you can redirect these log messages to a syslog server you could export them in realtime to a CSV and have an application like SNORT alalyze the traffic flows. Or you can log them locally on the device and then extract/parse them manually to look for anomalous traffic flows.

Improve this answer
-1

I think John Kennedy is right, there isn't anything out there that seems like it fits the bill on your questions; but I'll give a wag at it anyhow.

Can a Cisco router act as an IDS for LAN traffic that does not pass through it?

No, although there are certain Cisco devices that can act as an IDS/IPS. Cisco has an entire line of products specializing in this, specifically.

These will likely be massive overkill for your situation though.

Specifically, can traffic passing through a switch be port mirrored to an interface on the router with the router acting as an IDS?

This has always been possible with port-mirroring (SPAN ports). They functionally do exactly what you're looking for. They replicate traffic ingressing/egressing an interface/VLAN and spit it out on a pre-defined port/VLAN.

I am looking for a way to use an ISR G2 router like Snort to monitor traffic between devices on a LAN.

I'm not so sure this model supports custom code (like snort) in the way you're expecting it to.

Although not as elegant, you could always set up a standalone machine to run your IDS applications on.

Improve this answer
3
  • Cisco IOS routers cannot inspect traffic not passing through them - PERIOD. (Cisco IDS appliances are not routers) Again, the ability to "span" traffic isn't the question; an IOS router cannot inspect traffic that did not pass through it.
    – Ricky
    Nov 25, 2013 at 21:54
  • @RickyBeam You are correct, IOS cannot inspect traffic and the models listed won't act as a routing device. However, how is SPAN'ing not part of the question? He is asking about port-mirroring (i.e. Cisco SPAN technology)?
    – Ryan Foley
    Nov 25, 2013 at 22:05
  • short version: "can I SPAN traffic into the router acting as an IDS" Answer: still no. (the span isn't the question) Traffic must naturally flow through the router for the IOS IDS engine to work.
    – Ricky
    Nov 25, 2013 at 22:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.