[Snort-users] Snort in a switched environment

Andrew.Zielinski at ...1252... Andrew.Zielinski at ...1252...
Tue May 14 08:28:03 EDT 2002


If your switch allows it, you need to designate the port that Snort is
plugged into as a mirror port. This way all traffic on that switch is also
sent to the mirror port.

Andrew Zielinski


                                                                                                              
                    Bastian Ballmann                                                                          
                    <ballmann at ...3190...>                  To:     snort-users at lists.sourceforge.net            
                    Sent by:                             cc:                                                  
                    snort-users-admin at ...635...        Subject:     [Snort-users] Snort in a switched       
                    eforge.net                           environment                                          
                                                                                                              
                                                                                                              
                    05/14/2002 11:19 AM                                                                       
                                                                                                              
                                                                                                              




Hello!
Is it possible to run Snort in a switched environment? Cause Snort can only

sniff the traffic of the host he is running on. Unless he is doing
something
like ARP poisoning or something like this...
But I think this would lead into trouble if you run the arpspoof
preprocessor
;)
Greets

Bastian Ballmann
--
Bastian Ballmann [ ballmann at ...3190... ]
@ Computational Design GmbH
[ http://www.co-de.de ]

_______________________________________________________________

Have big pipes? SourceForge.net is looking for download mirrors. We supply
the hardware. You get the recognition. Email Us: bandwidth at ...382...
_______________________________________________
Snort-users mailing list
Snort-users at lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users








More information about the Snort-users mailing list