[Snort-users] SPAN

Chris Keladis Chris.Keladis at ...6400...
Mon Aug 26 08:32:17 EDT 2002

At 05:34 PM 19/08/2002 -0700, Tim wrote:

>Quick question, will snort sensors play with monitored ports on a Cisco 
>10/100 switch or is placing a hub be the better way to setup the sensors?

I'm no switching expert by any stretch of the imagination, but i guess it 
would depend on the amount of traffic your looking at.

A monitored port on a switch would work fine for low-traffic environments, 
but for higher speed monitoring it's more natural to use a hub.

Personally i like Ethernet taps the best, as they 'tap' into your network 
stream and split your traffic to your IDS systems.

One drawback with the taps is that they are usually Read-Only (there may be 
RW taps out there, i just have not seen them, myself), so you cant use any 
active-response features, which i don't agree with in principal anyway.

Anyway, just my 2quid. :)



More information about the Snort-users mailing list