RE: External snort monitoring

[swilcoxon () iqmarketing com]

Dual speed hubs act like a switch between the two different speeds. If your
two machines are at different speeds you won't see the other traffic.

S.W.

> -----Original Message-----
> From: Larry E. Smith Jr. [mailto:lsmithjr () monster-solutions net]
> Sent: Wednesday, August 08, 2001 12:01 PM
> To: Frank McPherson
> Cc: Snort List (E-mail); Snort Users
> Subject: Re: [Snort-users] External snort monitoring
>
>
> It shows in the system log as going into promiscuous mode. 
> and I called
> Linksys to verify that this is a hub and not a switch. and i 
> do not need to
> set an IP for the sensor correct?
>
> ----- Original Message -----
> From: "Frank McPherson" <fhmiv () mac com>
> To: "Larry E. Smith Jr." <lsmithjr () monster-solutions net>
> Cc: "Snort List (E-mail)" 
> <snort-users () lists sourceforge net>; "Snort Users"
> <snort-users () sourceforge net>
> Sent: Wednesday, August 08, 2001 12:11 PM
> Subject: Re: [Snort-users] External snort monitoring
>
>
>
> Two ideas:
>
> The ethernet interface on your external snort sensor is not in
> promiscuous mode;
>
> or
>
> your "hub" is really a switch.
>
> On Wednesday, August 8, 2001, at 11:12  AM, Larry E. Smith Jr. wrote:
>
> > I have my cable modem hooked into a Linksys 5 port hub and 
> I also have
> > a snort sensor configured on the hub to catch all traffic 
> coming to my
> > network. from the 5 port hub it connects into a Linksys 
> router which is
> > where my server is located. my question is why can i catch 
> traffic on
> > my internal snort sensor connected to the Linksys router, 
> but all I can
> > see are ARP requests on the external snort sensor which is 
> connected to
> > the hub? anyone have any ideas?
>
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> http://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=ort-users
>
>
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> http://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users