Re: External snort monitoring

[Frank McPherson <fhmiv () mac com>]

Two ideas:

The ethernet interface on your external snort sensor is not in 
promiscuous mode;

or

your "hub" is really a switch.

On Wednesday, August 8, 2001, at 11:12  AM, Larry E. Smith Jr. wrote:

> I have my cable modem hooked into a Linksys 5 port hub and I also have 
> a snort sensor configured on the hub to catch all traffic coming to my 
> network. from the 5 port hub it connects into a Linksys router which is 
> where my server is located. my question is why can i catch traffic on 
> my internal snort sensor connected to the Linksys router, but all I can 
> see are ARP requests on the external snort sensor which is connected to 
> the hub? anyone have any ideas?
>  

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users