[Snort-users] snort placement

neptuna neptuna at ...6520...
Sun Aug 4 14:33:01 EDT 2002

On Sun, 2002-08-04 at 16:00, David Yip wrote:
> Hey guys, be realistic! It's just a home network. Forget about tap or port 
> mirroring, either install on the gateway or use a hub. No matter how cheap 
> the DLink is, it's still a switch, you'll need a hub. It won't hurt to use 
> a hub since your traffic will not exceed 10-20MB on a cable connection. In 
> my opinion, putting it on the internal segment should be a better solution 
> for your situation since it will save you a lot of time and concentrate 
> only on the critical alerts that have come into your network. Trust me, 
> there are a lot of scanning going on, and you won't want to see thaem all, 
> let the firewall do its job.

Yes it is just a home network but I am interested in simulating a more Real 
world environment. Maybe for now I can use a hub and place snort on one
of the internal boxes like you suggested. In the future go with other

More information about the Snort-users mailing list