[Snort-users] Passive Tap Help

Frank Knobbe frank at ...9761...
Mon Dec 1 10:01:07 EST 2003


On Mon, 2003-12-01 at 11:49, Frank Knobbe wrote:
>  It is
> possible to use a second NIC and have two pcaps running and the IDS
> reassembling the data itself. Or you can have two NICs set up as a
> bonded/joined interface where the OS does the reassembling and a single
> instance of pcap and IDS runs over the traffic.

The third solution is to configure two interfaces in a Bridge
configuration and sniff on one of the interfaces.

(This is close to the bonded interface except that the bonded interface
appears as a single interface.)

-Frank

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 187 bytes
Desc: This is a digitally signed message part
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20031201/d254e094/attachment.sig>


More information about the Snort-users mailing list