No subject


Thu Nov 23 16:31:58 EST 2017


What I would like to do is have three nics in a sensor. One for the network
connection the other two being connected directly from the tap to the NIC.s
 
MY question is how do you setup snort to recognized that these two ports are
the same data stream. Is it necessary ?
 
Would like some guidance on this if you have the time...
 
thanks
Paul Powenski

------_=_NextPart_001_01C333EE.F3DEBE00
Content-Type: text/html

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii">
<TITLE>Message</TITLE>

<META content="MSHTML 6.00.2800.1141" name=GENERATOR></HEAD>
<BODY>
<DIV><SPAN class=451240310-16062003><FONT face=Arial size=2>I have setup the 
router/switch method of connecting a snort sensor, and I have used the hub 
method.</FONT></SPAN></DIV>
<DIV><SPAN class=451240310-16062003><FONT face=Arial 
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=451240310-16062003><FONT face=Arial size=2>From my 
investigations there are some flaws with both of them.</FONT></SPAN></DIV>
<DIV><SPAN class=451240310-16062003><FONT face=Arial 
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=451240310-16062003><FONT face=Arial size=2>What I would like to 
do is have three nics in a sensor. One for the network connection the other two 
being connected directly from the tap to the NIC.s</FONT></SPAN></DIV>
<DIV><SPAN class=451240310-16062003><FONT face=Arial 
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=451240310-16062003><FONT face=Arial size=2>MY question is how 
do you setup snort to recognized that these two ports are the same data stream. 
Is it necessary ?</FONT></SPAN></DIV>
<DIV><SPAN class=451240310-16062003><FONT face=Arial 
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=451240310-16062003><FONT face=Arial size=2>Would like some 
guidance on this if you have the time...</FONT></SPAN></DIV>
<DIV><SPAN class=451240310-16062003><FONT face=Arial 
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=451240310-16062003><FONT face=Arial 
size=2>thanks</FONT></SPAN></DIV>
<DIV><SPAN class=451240310-16062003><FONT face=Arial size=2>Paul 
Powenski</FONT></SPAN></DIV></BODY></HTML>

------_=_NextPart_001_01C333EE.F3DEBE00--




More information about the Snort-devel mailing list