[Snort-users] Ethernet Taps
fknobbe at ...652...
Sat Sep 28 14:19:03 EDT 2002
On Sat, 2002-09-28 at 15:18, Gary Borgeson wrote:
> Or connect the 2 mirror ports and a single NIC sensor to a hub (doesn't
> sound optimal)?
If the mirror ports are unbuffered (like most taps are), you will be
loosing packets due to collisions on the hub. You should connect the
taps to a switch instead and configure the switch such that you dedicate
a monitor port to receive packets from both input ports. Then connect
Snort to the monitor port.
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 307 bytes
Desc: This is a digitally signed message part
More information about the Snort-users