AW: [Snort-users] Taps

Poppi, Sandro Sandro.Poppi at ...3316...
Mon Jun 16 05:32:38 EDT 2003

I've been using linux' "channel bonding" feature with 100base tx and 100base
SX cards and snort. Worked without probs (as far as I remember ;) Simply
make snort listen on the bonded interface, reassemblation of the tap streams
is done by the kernel.

Been through the details on hubs and spanning. Not completely happy with
those options
What would be nice to know is how do you configure snort to use two
interfaces from a TAP.
Does the reassembly occur in the OS ( I have heard that OpenBSD can be
configured to perform this)
Does not seem to be any info on how this is accomplished.
Paul Powenski

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <>

More information about the Snort-users mailing list