[Snort-users] snort implement questions?
vcba79 at ...6112...
Fri Jul 26 10:42:09 EDT 2002
I got 2 questions about snort implement:
1. if I connect snort to a HUB, promiscuous mode should be enabled to
let snort see all activities. right?
But if I run snort on a gateway which also act as firewall, is it necessary
to enable promiscuous mode? all inbound and outbound traffice will go
through this box in this case.
2. I saw an article which mentioned TAP device recently. I don't quite
understand this article. if my switch can redirect all traffic to the port
which snort box connected to, do I need such a device?
More information about the Snort-users