Placement of Snort IDS

[Kenny D <bitored2002 () yahoo com au>]

Hi,

I need to know  where to place a snort ids in a
switched environment. Is it setup with a promiscuous
mode port and port mirroring configured in the switch?
Or is it setup to have all traffic pass through it so
that it would act as a default gateway between
servers/users and the firewall?

Someone told me that snort can drop packets if there
is a rule matched, im not so sure. I thought snort
logged not dropped. Thats why i have begun to rethink
its placement. Who is right or wrong?

Thanks.

http://www.sold.com.au - SOLD.com.au Auctions
- 1,000s of Bargains!

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users