[Snort-users] snort implement questions?

Vincent Chen vcba79 at ...6112...
Fri Jul 26 10:42:09 EDT 2002


Dear all,

I got 2 questions about snort implement:

1. if I connect snort to a HUB, promiscuous mode should be enabled to
let snort see all activities. right?
But if I run snort on a gateway which also act as firewall, is it necessary
to enable promiscuous mode? all inbound and outbound traffice will go
through this box in this case.

2. I saw an article which mentioned TAP device recently. I don't quite
understand this article. if my switch can redirect all traffic to the port
which snort box connected to, do I need such a device?


Best regards,

Vincent Chen






More information about the Snort-users mailing list