[Snort-users] Snort in a switched environment

Andrew.Zielinski at ...1252... Andrew.Zielinski at ...1252...
Tue May 14 08:28:03 EDT 2002

If your switch allows it, you need to designate the port that Snort is
plugged into as a mirror port. This way all traffic on that switch is also
sent to the mirror port.

Andrew Zielinski

                    Bastian Ballmann                                                                          
                    <ballmann at ...3190...>                  To:     snort-users at lists.sourceforge.net            
                    Sent by:                             cc:                                                  
                    snort-users-admin at ...635...        Subject:     [Snort-users] Snort in a switched       
                    eforge.net                           environment                                          
                    05/14/2002 11:19 AM                                                                       

Is it possible to run Snort in a switched environment? Cause Snort can only

sniff the traffic of the host he is running on. Unless he is doing
like ARP poisoning or something like this...
But I think this would lead into trouble if you run the arpspoof

Bastian Ballmann
Bastian Ballmann [ ballmann at ...3190... ]
@ Computational Design GmbH
[ http://www.co-de.de ]


Have big pipes? SourceForge.net is looking for download mirrors. We supply
the hardware. You get the recognition. Email Us: bandwidth at ...382...
Snort-users mailing list
Snort-users at lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
Snort-users list archive:

More information about the Snort-users mailing list