Snort mailing list archives
Re: Switched hub
From: "Alex Butcher, ISC/ISYS" <Alex.Butcher () bristol ac uk>
Date: Wed, 15 Sep 2004 09:04:35 +0100
--On 15 September 2004 07:17 +0000 patrick.marquetecken () pandora be wrote:
In about 1 month we are going to switch from a DMZ hub to a switch network. Wat is the best way for following the network traffic, as normal its not possible to view other ports with a switch network.
Actually, it is with plenty of switches (especially cheap, unmanaged switches), if you them with ARP announcements so that they degrade into hub mode. But I digress, as that isn't really a sensible solution for your problem. ;-)
What you need to do is to configure a SPAN or mirror port on your switches and connect your NIDS sensor(s) to those, or place taps between switches and connect your NIDS sensor(s) to those. Which approach you take depends on what you want to see.
TIA Patrick
Best Regards, Alex. -- Alex Butcher: Security & Integrity, Personal Computer Systems Group Information Systems and Computing GPG Key ID: F9B27DC9 GPG Fingerprint: D62A DD83 A0B8 D174 49C4 2849 832D 6C72 F9B2 7DC9 ------------------------------------------------------- This SF.Net email is sponsored by: thawte's Crypto Challenge Vl Crack the code and win a Sony DCRHC40 MiniDV Digital Handycam Camcorder. More prizes in the weekly Lunch Hour Challenge. Sign up NOW http://ad.doubleclick.net/clk;10740251;10262165;m _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Switched hub patrick . marquetecken (Sep 15)
- Re: Switched hub Alex Butcher, ISC/ISYS (Sep 15)
- Re: Switched hub Rich Adamson (Sep 15)
- Re: Switched hub Lyndon Tiu (Sep 15)
- Re: Switched hub Jose Maria Lopez (Sep 15)
- Re: Switched hub Patrick Marquetecken (Sep 16)