[Snort-users] Snort not seeing everything

fname lname larskman at ...11827...
Wed Jun 14 09:47:23 EDT 2006


Our office resently moved to a new location and now my snort not seeing
everything so it must be something I didnt setup right.

They way I have it setup is right off of the pix inside cable its going to a
passive tap that i build from the docs on snorts site from there its going
to the networks switch.  From that we have a few servers plugged in and
another switch where a few more servers are and the lastly another switch
where the workstations are plugged into.

INTERNET---pix---TAP---switch1
                             |            |
                           IDS     switch2
                                          |
                                     switch3

The above drawing is how the network is setup based on funds;  Based on the
drawing if a workstation on switch3 goes to www.google.com should I see that
traffic because I have a TAP in the inside wire of the pix which is the last
route to the internet?

Hmm, im thinking should I change the above network to look like this?


INTERNET---pix---TAP---switch1---switch3
                             |          |
                           IDS   switch2

Thank you for help in advance.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20060614/4760b78a/attachment.html>


More information about the Snort-users mailing list