[Snort-users] 802.1q Monitoring
rshuck at ...6736...
Thu Jun 5 13:50:05 EDT 2003
Has anyone implemented or tried to monitor a 802.1q (trunked) connection
with Snort? I saw that DLink has a 802.1q compatible card, and that it
appears to be supported under Linux. I have several remote locations
that do not have a huge amount of traffic, but there are several VLANS.
It would be much easier and get the most coverage to port mirror/tap the
WAN connection, but it is trunked.
Any help would be greatly appreciated.
Ron Shuck, CISSP, GCIA, CCSE - Managing Consultant
Buchanan Associates - A Technology Company in the People Business
More information about the Snort-users