[Snort-users] How to place Snort machine on the network ?

Greg Herlein gherlein at ...3379...
Tue Jan 8 13:55:05 EST 2002


> then the switch is likely to be misconfigured. To confirm this, turn off
> snort & launch tcpdump then send some traffic from one host to another
> (without involving the snort box of course). 

Or just start snort in capture mode - 

	snort -avd

:)  I found snort initially because it was a much more readable
packet sniffer than tcpdump format.  I got hooked on it's IDS
capabilities, but still use it for capture all the time... though
tethereal is nifty for it's higher layer analysis capabilites.

Greg





More information about the Snort-users mailing list