[Snort-users] Snort not seeing everything
Stephen John Smoogen
smooge at ...11827...
Wed Jun 14 11:31:51 EDT 2006
On 6/14/06, Eric Hines <eric.hines at ...8860...> wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> This doesn't look right. Why would you install a Tap, then hang the
> Snort sensor off the switch? The purpose of the tap is to tap in to the
> network and replace span ports on your switch. The Snort sensor is
> supposed to be hanging off the monitoring port of the Tap.
I do not see where he is putting the snort sensor on the switch. The
IDS seems to stay in the same spot.. the last jump out/first jump in.
Stephen J Smoogen.
CSIRT/Linux System Administrator
More information about the Snort-users