AW: [Snort-users] switch

Poppi, Sandro Sandro.Poppi at ...3316...
Wed May 15 06:56:02 EDT 2002


I would recommend using a tap instead of a hub for the following reason:

If the hub fails the whole connection is unavailable while using a tap
ensures that if the tap fails the connection is still working. The problem
with taps is that you get 2 streams which have to be combined anyhow. With
linux you can use two nics and enable kernel channel bonding which creates a
virtual interface with 2 physical ones (see
http://sourceforge.net/projects/bonding for details).

If you don't care about a failed hub than of course this solution is the
cheaper one ;)

Ciao,
Sandro
> 
> throw a hub in-between the switch and the wan
> connection and listen away...
> 
> -----Original Message-----
> From: Edin Dizdarevic [mailto:edin.dizdarevic at ...5862...] 
> Sent: Wednesday, May 15, 2002 11:00 AM
> To: Alwin Raymundo
> Cc: snort-users at lists.sourceforge.net
> Subject: Re: [Snort-users] switch
> 
> 
> 
> 
> So, three clicks away:
> 
> http://www.netgear.com/switches_main.asp
> 
> Your switch does not have any management possibilities.
> 
> Regards,
> 
> Edin-
> 
> 
> 
> Alwin Raymundo schrieb:
> > Hi Everybody,
> > 
> > On Snort FAQ
> > 
> > Q: I'm on a switched network, can I still use Snort?
> > 
> > A: Being able to sniff on a switched network depends
> > on what type of switch is being used.  If the switch
> > can mirror traffic, then set the switch to mirror all
> > traffic to the snort machine's port.
> > 
> > I recently installed netgear Model FS 524. Does my
> > switch capable of mirroring the traffic?
> > 
> > Does anyone knows or HOWTO.  I want to learn about
> > this.
> > 
> > Your help is highly appreciated.
> > 
> > Thanks
> > 
> > brother in snort
> > 
> > =====
> > Alwin Raymundo
> > 
> > __________________________________________________
> > Do You Yahoo!?
> > LAUNCH - Your Yahoo! Music Experience
> > http://launch.yahoo.com
> > 
> > _______________________________________________________________
> > 
> > Have big pipes? SourceForge.net is looking for download mirrors. We 
> > supply the hardware. You get the recognition. Email Us: 
> > bandwidth at ...382... 
> > _______________________________________________
> > Snort-users mailing list
> > Snort-users at lists.sourceforge.net
> > Go to this URL to change user options or unsubscribe:
> > https://lists.sourceforge.net/lists/listinfo/snort-users
> > Snort-users list archive:
> > http://www.geocrawler.com/redir-sf.php3?list=snort-users
> 
> 
> _______________________________________________________________
> 
> Have big pipes? SourceForge.net is looking for download 
> mirrors. We supply
> the hardware. You get the recognition. Email Us: 
> bandwidth at ...382...
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users
> 
> _______________________________________________________________
> 
> Have big pipes? SourceForge.net is looking for download 
> mirrors. We supply
> the hardware. You get the recognition. Email Us: 
> bandwidth at ...382...
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users
> 




More information about the Snort-users mailing list