RE: using a tap

["Gould, Scott" <sgould () gogstats org>]

If you buy an aggregated tap, it sends TX and RX of the tapped lines to
the same single NIC.
The tap is read only, and for ultra neurotic security use a read only
cable, and do not assign an IP address to the nic connected to the tap

Scott Gould

GOG Network Specialist

Gynecologic Oncology Group 

Statistical & Data Center

716-845-5702


-----Original Message-----
From: snort-users-admin () lists sourceforge net
[mailto:snort-users-admin () lists sourceforge net] On Behalf Of Altrock,
Jens
Sent: Friday, June 11, 2004 1:41 AM
To: Snort-Users (E-Mail)
Subject: [Snort-users] using a tap

hi there,
we're thinking about buying a tap too, but there are some questions that
I
need to be answered before:

1. Taps use to channels to get the traffic to the monitoring device (one
for
RX and one for TX). How do I "bond" these channels 
together, if I do need to do that?

2. It is a security violation when using a Sensor connected to the Tap
and
(!) to the internal net (with IP), but it is needed anyway for updating
rules and 
other issues. Is it anyway reliable? 

Maybe the questions seem to be stupid, anyway they need to be answered
for
me :-/

Regards,

Jens
###########################################
Diese Nachricht wurde von F-Secure Anti-Virus gescannt.

This message has been scanned by F-Secure Anti-Virus.



-------------------------------------------------------
This SF.Net email is sponsored by the new InstallShield X.
> From Windows to Linux, servers to mobile, InstallShield X is the
one installation-authoring solution that does it all. Learn more and
evaluate today! http://www.installshield.com/Dev2Dev/0504
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users




-------------------------------------------------------
This SF.Net email is sponsored by the new InstallShield X.
> From Windows to Linux, servers to mobile, InstallShield X is the
one installation-authoring solution that does it all. Learn more and
evaluate today! http://www.installshield.com/Dev2Dev/0504
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users