[Snort-users] Passive Tap Help
frank at ...9761...
Mon Dec 1 10:01:07 EST 2003
On Mon, 2003-12-01 at 11:49, Frank Knobbe wrote:
> It is
> possible to use a second NIC and have two pcaps running and the IDS
> reassembling the data itself. Or you can have two NICs set up as a
> bonded/joined interface where the OS does the reassembling and a single
> instance of pcap and IDS runs over the traffic.
The third solution is to configure two interfaces in a Bridge
configuration and sniff on one of the interfaces.
(This is close to the bonded interface except that the bonded interface
appears as a single interface.)
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 187 bytes
Desc: This is a digitally signed message part
More information about the Snort-users