Linux Journal: Stealthful Sniffing, Intrusion Detection and Logging

“In a column about syslog I mentioned ‘stealth logging’–by
running your central log server without an IP address, you can hide
your central log server from intruders. But log servers aren’t the
only type of system that can benefit from a little stealth. Network
sniffers and network intrusion detection systems (NIDSes) probes
can also function perfectly well without IP addresses, making them
less vulnerable to network attacks than the systems they
protect.

“This month I demonstrate three ways to use the versatile and
powerful Snort–as a stealth sniffer, a stealth NIDS probe and a
stealth logger–on a network interface with no IP address. If
you’re already familiar with Snort, I hope you’ll see how easily it
can be used stealthfully. If you’re new to Snort, this article may
be a useful crash course for you. All Snort commands and
configurations in this article work equally well on interfaces with
and without IP addresses…”

Complete
Story