Re: snort setup

[Demetri Mouratis <dmourati () cm math uiuc edu>]

On Fri, 12 Jul 2002, Alwin Raymundo wrote:

> Hi all,
>
> Here is my another naive question.  I want to put my
> snort box in front of my switch because my swith is
> not capable of port mirroring.
>
> internet -> cisco router -> snort box -> switch ->
> servers
>
> My future setup on snort box (redhat 7.3, snort -mysql
> and 2 nic cards).
>
> here now the question about the 2 nic what should I
> used ip address to these 2 nic cards, should it be 2
> public ip address? or 1 public IP address and 1
> network address.
>
> any help would be highly appreciated.
>
> Thanks in advance, brother in snort.

Totally up to you and how you want to handle your routing.  Just make sure
the packets reach the snort box.

You could also achieve the same result by placing a hub between the Cisco
and the switch, and hanging snort off the hub.  That way, you could leave
all the IPs on your router and switch the same.  Read the FAQ regarding
taps, configuring snort without an IP, etc.

Good luck.

---------------------------------------------------------------------
Demetri Mouratis
dmourati () linfactory com



-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Gadgets, caffeine, t-shirts, fun stuff.
http://thinkgeek.com/sf
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users