Re: Snort in a switched environment

["Justin M. Parker" <bluesman () pneumatek net>]

---------- Forwarded message ----------
Date: Tue, 14 May 2002 18:30:58 +0000
From: Edin Dizdarevic <edin.dizdarevic () brainMedia de>
To: Justin M. Parker <bluesman () pneumatek net>
Subject: Re: [Snort-users] Snort in a switched environment

Hi all,

isn't it a well known "switch-attack" to let a switch
exceed the internal ARP-Buffer so it switch back to the
hub mode. I don't think it's a good idea, since it lowers the
performance extremely. You may try taking a hub for those
special hosts you want to listen to. If you don't have a switch
with monitorig capability think about buying one. Since all better
switches are manageable in that issue you may be lucky and the
present one can do the job.

Hope could help!

best regards,

-- 
Edin Dizdarevic


_______________________________________________________________

Have big pipes? SourceForge.net is looking for download mirrors. We supply
the hardware. You get the recognition. Email Us: bandwidth () sourceforge net
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users