[Snort-users] Ethernet Taps
gborgeson at ...7012...
Sat Sep 28 13:19:03 EDT 2002
What is our favorite Ethernet tap? I'm also interested in how most folks
connect these devices to sensors.
I'm looking at the NetOptics 10/100 Copper Tap and notice it has 4 ports.
Obviously 2 ports are for each side of the split, but I assume the other 2
ports are for mirroring the 2 sides.
So, with this device and similar ones, do you connect the 2 mirror ports to
2 different NICs in your sensor? Then run 2 instances of Snort? How does
that affect logging? What about a dual-port NIC if you are out of slots?
Or connect the 2 mirror ports and a single NIC sensor to a hub (doesn't
More information about the Snort-users