[Snort-users] Ethernet Tap
richard_bejtlich at ...131...
Fri Apr 16 08:32:14 EDT 2004
Sean Lazar wrote:
The reason for a two card setup with a tap is to
physically prevent your IDS from ever transmitting.
Don't forget that a tap preserves the full duplex
nature of a link, unlike a hub. The two outputs to
the probe on a traditional tap represent the two TX
sides of a full duplex conversation. That's why
traditional tap outputs feed into two probe NICs.
I say "traditional tap" because the new Net Optics
10/100 Ethernet Port Aggregator Tap is the first
device to offer a RAM-buffered single output.
I don't buy the "buy a switch" argument either. I did
a cost and feature comparison at my Blog:
Jens Altrock wrote:
I'd need a software that reassembles the network
traffic in a way right?
I just posted on my Blog the method I use to combine
separate physical NIC traffic into a single virtual
When you have that single virtual NIC, you can run
Tcpdump or Snort against it without problems.
for info on the Net Optics product.
Do you Yahoo!?
Yahoo! Tax Center - File online by April 15th
More information about the Snort-users