[Snort-users] cheap monitoring

/dev/null dev.null at ...9081...
Thu Jul 31 22:43:03 EDT 2003


I have a *very* low bandwidth link I'd like to monitor.  At it's peak it
touches 300KB, which isn't often.  There are only two boxes connected at
10Meg.  Right now we have a switch connecting them and would like to
downgrade that to a hub so we can monitor the traffic.

Any suggestions on the cheapest route?  I imagine a 10Base hub should be
dirt-cheap, but may also be hard to find.

Is there a better way?

Also, are there any papers that show the different ways to monitor the
traffic scalling from low-traffic to high-traffic links?

Thanks!





More information about the Snort-users mailing list