RE: Snort in a switched environment

["McCammon, Keith" <Keith.McCammon () eadvancemed com>]

Unless you specify otherwise via a command-line argument, the interface will be operating in promiscuous mode, and will 
inspect any packet that comes across the wire.

As far as switching is concerned, you'll want to place your sensor on a monitoring/mirroring port, so that it captures 
the appropriate traffic in the appropriate direction.

-----Original Message-----
From: Bastian Ballmann [mailto:ballmann () co-de de]
Sent: Tuesday, May 14, 2002 11:20 AM
To: snort-users () lists sourceforge net
Subject: [Snort-users] Snort in a switched environment


Hello!
Is it possible to run Snort in a switched environment? Cause Snort can only 
sniff the traffic of the host he is running on. Unless he is doing something 
like ARP poisoning or something like this...
But I think this would lead into trouble if you run the arpspoof preprocessor 
;)
Greets

Bastian Ballmann
-- 
Bastian Ballmann [ ballmann () co-de de ]
@ Computational Design GmbH
[ http://www.co-de.de ]

_______________________________________________________________

Have big pipes? SourceForge.net is looking for download mirrors. We supply
the hardware. You get the recognition. Email Us: bandwidth () sourceforge net
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users

_______________________________________________________________

Have big pipes? SourceForge.net is looking for download mirrors. We supply
the hardware. You get the recognition. Email Us: bandwidth () sourceforge net
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users