[Snort-users] Need to monitor 2GB Etherchannel trunk

Joe S js.lists at ...11827...
Tue Oct 4 13:01:03 EDT 2005

eric wrote:
> On Tue, 2005-10-04 at 12:33:01 -0700, Joe S proclaimed...
>>Any suggestions on how to do this?
> OpenBSD 3.8 will support trunk interfaces. You can then just monitor the
> trunk interface. We do that, but with a bridge interface. So basically, in
> our config, we monitor bridge0.

Seems like that would work. Unfortunately, my taps are 1gig taps. The 
etherchannel links are 2gig.

I dont know much about etherchannel. Won't there be some sort of media 

More information about the Snort-users mailing list