[Snort-users] Snort not seeing everything

Stephen John Smoogen smooge at ...11827...
Wed Jun 14 11:31:51 EDT 2006


On 6/14/06, Eric Hines <eric.hines at ...8860...> wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> This doesn't look right. Why would you install a Tap, then hang the
> Snort sensor off the switch? The purpose of the tap is to tap in to the
> network and replace span ports on your switch. The Snort sensor is
> supposed to be hanging off the monitoring port of the Tap.
>

I do not see where he is putting the snort sensor on the switch. The
IDS seems to stay in the same spot.. the last jump out/first jump in.

-- 
Stephen J Smoogen.
CSIRT/Linux System Administrator




More information about the Snort-users mailing list