[Snort-users] Need to monitor 2GB Etherchannel trunk

Joe S js.lists at ...11827...
Tue Oct 4 13:01:03 EDT 2005


eric wrote:
> On Tue, 2005-10-04 at 12:33:01 -0700, Joe S proclaimed...
> 
> 
>>Any suggestions on how to do this?
> 
> 
> OpenBSD 3.8 will support trunk interfaces. You can then just monitor the
> trunk interface. We do that, but with a bridge interface. So basically, in
> our config, we monitor bridge0.
> 

Seems like that would work. Unfortunately, my taps are 1gig taps. The 
etherchannel links are 2gig.

I dont know much about etherchannel. Won't there be some sort of media 
mismatch?




More information about the Snort-users mailing list