[Snort-users] Ethernet Taps

Gary Borgeson gborgeson at ...7012...
Sat Sep 28 13:19:03 EDT 2002

What is our favorite Ethernet tap? I'm also interested in how most folks
connect these devices to sensors. 

I'm looking at the NetOptics 10/100 Copper Tap and notice it has 4 ports.
Obviously 2 ports are for each side of the split, but I assume the other 2
ports are for mirroring the 2 sides. 

So, with this device and similar ones, do you connect the 2 mirror ports to
2 different NICs in your sensor? Then run 2 instances of Snort? How does
that affect logging? What about a dual-port NIC if you are out of slots?

Or connect the 2 mirror ports and a single NIC sensor to a hub (doesn't
sound optimal)?

Thanks, G


More information about the Snort-users mailing list