[Snort-users] Ethernet Taps

Frank Knobbe fknobbe at ...652...
Sat Sep 28 14:19:03 EDT 2002


On Sat, 2002-09-28 at 15:18, Gary Borgeson wrote:
> [...]
> Or connect the 2 mirror ports and a single NIC sensor to a hub (doesn't
> sound optimal)?

If the mirror ports are unbuffered (like most taps are), you will be
loosing packets due to collisions on the hub. You should connect the
taps to a switch instead and configure the switch such that you dedicate
a monitor port to receive packets from both input ports. Then connect
Snort to the monitor port.

Regards,
Frank

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 307 bytes
Desc: This is a digitally signed message part
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20020928/e7f4de45/attachment.sig>


More information about the Snort-users mailing list