[Snort-users] Port Aggregator Tap alternatives for snort sensor

Andrew Willy andrewwilly at ...11827...
Mon Mar 3 19:39:45 EST 2008


Is the same sensor to analyze the multiple taps? You may define multiple
source interfaces or VLANs in the same monitoring session.

monitor session 1 source interface fa0/1,fa0/2,fa03

Andrew


On Mon, Mar 3, 2008 at 4:55 PM, Stephen Reese <rsreese at ...11827...> wrote:

> I've been using a Cisco 2950 for single tap I have setup and it has
> worked fine to date.
>
> !
> interface FastEthernet0/1
>  switchport access vlan 100
>  duplex full
> !
> interface FastEthernet0/2
>  switchport access vlan 100
>  duplex full
> !
> !
> monitor session 1 source interface Fa0/1
> monitor session 1 destination interface Fa0/3
>
> Port one is the internet source, port two is to my routing device and
> three is to my sensor.
>
> I would like to setup some more taps without having to run more
> switches. An alternative is to purchase a tap still (around $300) or
> making one from scratch
> (http://www.altsec.info/passive-network-tap.html) but I would prefer
> not to have to deal with bonding interfaces. I was considering another
> 2950 switch (still cost around $250 used) but I figure there has got
> to be a better solution? A port aggregator seems to be out of the
> question since they seem to run around $1000...
>
> Any recommendations? Thanks.
>
> -------------------------------------------------------------------------
> This SF.net email is sponsored by: Microsoft
> Defy all challenges. Microsoft(R) Visual Studio 2008.
> http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users<https://lists.sourceforge.net/lists/listinfo/snort-usersSnort-users>list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20080303/30350301/attachment.html>


More information about the Snort-users mailing list