SonicOS 7 System

Technical Documentation > SonicOS 7 System > Interfaces > About Interfaces > IPS Sniffer Mode

IPS Sniffer Mode

Supported on SonicWall firewalls, IPS Sniffer Mode is a variation of Layer 2 Bridged Mode that is used for intrusion detection. IPS Sniffer Mode configuration allows an interface on the appliance to be connected to a mirrored port on a switch to examine network traffic. Typically, this configuration is used with a switch inside the main gateway to monitor traffic on the intranet.

In IPS Sniffer Mode: Network diagram, traffic flows into a switch in the local network and is mirrored through a switch mirror port into a IPS Sniffer Mode interface on the appliance. The appliance inspects the packets according to the settings configured on the Bridge-Pair. Alerts can trigger SNMP traps that are sent to the specified SNMP manager through another interface on the appliance. The network traffic is discarded after the appliance inspects it.

The WAN interface of the appliance is used to connect to the firewall Data Center for signature updates or other data.

IPS Sniffer Mode: Network Diagram

IPS Sniffer Mode

In IPS Sniffer Mode, a Layer 2 Bridge is configured between two interfaces in the same zone on the appliance, such as LAN-LAN or DMZ-DMZ. You can also create a custom zone to use for the Layer 2 Bridge.

Only the WAN zone is not appropriate for IPS Sniffer Mode. The reason for this is that SonicOS detects all signatures on traffic within the same zone such as LAN-LAN traffic, but some directional specific (client-side versus server-side) signatures do not apply to some LAN-WAN cases.

Either interface of the Layer 2 Bridge can be connected to the mirrored port on the switch. As network traffic traverses the switch, the traffic is also sent to the mirrored port and from there into the appliance for deep packet inspection. Malicious events trigger alerts and log entries, and if SNMP is enabled, SNMP traps are sent to the configured IP address of the SNMP manager system. The traffic does not actually continue to the other interface of the Layer 2 Bridge. IPS Sniffer Mode does not place the appliance inline with the network traffic, it only provides a way to inspect the traffic.

The Edit Interfaces dialog available from the NETWORK | System > Interfaces page provides an option, Only sniff traffic on this bridge-pair, for use when configuring IPS Sniffer Mode. When selected, this option causes the appliance to inspect all packets that arrive on the L2 Bridge from the mirrored switch port. The Never route traffic on this bridge-pair option should also be selected for IPS Sniffer Mode to ensure that the traffic from the mirrored switch port is not sent back out onto the network.

For detailed instructions on configuring interfaces in IPS Sniffer Mode, see Configuring IPS Sniffer Mode.

Was This Article Helpful?

Help us to improve our support portal

Yes! Not Really

Techdocs Article Helpful form

  • Hidden
  • Hidden

Techdocs Article NOT Helpful form

  • Still can't find what you're looking for? Try our knowledge base or ask our community for more help.
  • Hidden
  • Hidden