[Snort-users] duplicating traffic to snort box
Crist J. Clark
cjclark at ...960...
Wed Mar 7 02:49:04 EST 2001
On Tue, Mar 06, 2001 at 10:52:24AM -0600, Scott Johnson wrote:
> I've got snort running on my FreeBSD gateway right now, but I'd like to
> have snort on a separate box. I'm using ipfw, but I can't see a way to
> duplicate the traffic to another interface (with no IP address) so I'm
> considering switching to ipf and using dup-to. Is there another way? How
> do linux users do this?
The 'tee' action might be a start.
Crist J. Clark cjclark at ...485...
More information about the Snort-users