[Snort-users] duplicating traffic to snort box

Crist J. Clark cjclark at ...960...
Wed Mar 7 02:49:04 EST 2001


On Tue, Mar 06, 2001 at 10:52:24AM -0600, Scott Johnson wrote:
> I've got snort running on my FreeBSD gateway right now, but I'd like to
> have snort on a separate box. I'm using ipfw, but I can't see a way to
> duplicate the traffic to another interface (with no IP address) so I'm
> considering switching to ipf and using dup-to. Is there another way? How
> do linux users do this?

The 'tee' action might be a start.
-- 
Crist J. Clark                           cjclark at ...485...




More information about the Snort-users mailing list