[Snort-users] 802.1q Monitoring

Ron Shuck rshuck at ...6736...
Thu Jun 5 13:50:05 EDT 2003


Has anyone implemented or tried to monitor a 802.1q (trunked) connection
with Snort? I saw that DLink has a 802.1q compatible card, and that it
appears to be supported under Linux. I have several remote locations
that do not have a huge amount of traffic, but there are several VLANS.
It would be much easier and get the most coverage to port mirror/tap the
WAN connection, but it is trunked. 

Any help would be greatly appreciated.


Ron Shuck, CISSP, GCIA, CCSE - Managing Consultant 
Buchanan Associates - A Technology Company in the People Business 

More information about the Snort-users mailing list