[Snort-users] snort and atm

Matt Kettler mkettler at ...4108...
Tue Feb 8 08:54:16 EST 2005

At 06:37 AM 2/8/2005, Teva AVRIL wrote:
>i'm planning to use snort to monitor an ATM connection, using a passive
>splitter to send all traffic to a linux box with an ATM card. Have anyone
>experimented the use of ATM cards in Linux with snort ?
>According some mails sent by snorts-users, It seems that snort doesn't
>handle ATM.

That's true as far as I know...

>So if it's not possible, i'd like to know if it's possible to monitor the
>traffic by forwarding the traffic coming in the atm card to an ethernet
>card (installed on the same station) and then monitor with snort?

That should work fine, although you need to make sure the packets can 
actually go out on the interface. Merely forwarding the packets won't work 
if they all get dropped due to lack of route.

More information about the Snort-users mailing list