Re: Snort not seeing everything

["Stephen John Smoogen" <smooge () gmail com>]

On 6/14/06, Eric Hines <eric.hines () appliedwatch com> wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> This doesn't look right. Why would you install a Tap, then hang the
> Snort sensor off the switch? The purpose of the tap is to tap in to the
> network and replace span ports on your switch. The Snort sensor is
> supposed to be hanging off the monitoring port of the Tap.

I do not see where he is putting the snort sensor on the switch. The
IDS seems to stay in the same spot.. the last jump out/first jump in.

-- 
Stephen J Smoogen.
CSIRT/Linux System Administrator


_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users