In case I needed the data, I can simply walk over, grep the usb stick/external hd and attach it to the analysis system. I decided to use a external usb storage attached to the pfsense box. If you encounter an incident and you have to copy all the traffic over the network… might take too mutch time, the network might even no longer be available. In the past the file system was mounted read-only (that changed recently) but there are more reasons to that.
It might not be the best idea to save the traffic to the actual file system your pfsense is running on. First of all, if you might ask yourself the question “Why should I?” here are two answers - you choose which one works best for you:Ģ) In case of an incident it might be very helpful and there is no traveling back in time and get a second chance.
0 kommentar(er)
