[Snort-users] Snort not seeing everything

Stephen John Smoogen smooge at ...11827...
Wed Jun 14 11:31:51 EDT 2006

On 6/14/06, Eric Hines <eric.hines at ...8860...> wrote:
> Hash: SHA1
> This doesn't look right. Why would you install a Tap, then hang the
> Snort sensor off the switch? The purpose of the tap is to tap in to the
> network and replace span ports on your switch. The Snort sensor is
> supposed to be hanging off the monitoring port of the Tap.

I do not see where he is putting the snort sensor on the switch. The
IDS seems to stay in the same spot.. the last jump out/first jump in.

Stephen J Smoogen.
CSIRT/Linux System Administrator

More information about the Snort-users mailing list