[Snort-users] About to setup snort

Shaun T. Erickson ste at ...11690...
Fri May 21 06:39:10 EDT 2004


Truax, Shawn (MBS) wrote:

> You might run into some issues with those HUBs.  Depending on the amount of
> traffic you have on your network you may run into some heavy collision
> situations.  Before you go all crazy and install the whole solution I would
> put in one of the HUBs and see how things run for a day or so.  If users
> start calling up complaining about performance or connectivity you may have
> to invest in some taps or switchs that have span ports.  Another option for
> you may be the  Do-It-Yourself Tap instructions on the Snort Website.  If
> you have trouble with the Hubs try those.  I wouldn't recommend them for
> high traffic areas but they may be good enough for you and get you somewhere
> that is better than a HUB but cheaper then the new switches.

James Edwards wrote:
 >
 > Well, yuck. Test this. Once a local host gets an infection
 > that makes a lot of traffic you will see why this is a bad idea.

I understand that the hubs are a sub-optimal solution, but I'm told we 
simply cannot afford anything else, at the moment. I'll look at the 
Do-It-Yourself Tap. Thankfully, though, we have very low traffic here.

	-ste




More information about the Snort-users mailing list