[Snort-users] snort placement

Christopher Cook crcook at ...6518...
Sun Aug 4 11:35:03 EDT 2002

you can put Snort where ever you would like it to be.

If I read correctly, this is your current setup

Cable Modem ----- Router/FW ---- Dlink switch ---- 3 computers.

Snort can be placed in many areas:  Probably the most beneficial would 
be in front and behind the router/FW, this way you know what you're 
being attacked with and what's getting through the FW.

CM ---- Snort --- Router/FW --- Snort ---- Switch ---- computers.

You can also hook it up to an open port on the switch and monitor 
traffic that way.  All these options are dependent on separate boxes 
doing Snort.

Chris Cook
Security and Support Specialist
Office of Information Technology
Oakland University

neptuna wrote:

>I am new to snort. I have a simple home LAN, with a Cable modem and a
>linux box acting as a Router/ FW.  I have 3 machines on the inside. All
>are connected to a cheap little D-link switch. Is my only option to put
>snort on the Linux Router/FW ? 
>I have read the FAQ concerning this but i am still not sure. Any
>suggestions or pointers to more documentation is appreciated.
>This sf.net email is sponsored by:ThinkGeek
>Welcome to geek heaven.
>Snort-users mailing list
>Snort-users at lists.sourceforge.net
>Go to this URL to change user options or unsubscribe:
>Snort-users list archive:

More information about the Snort-users mailing list