Re: ideal setup

[Keith Young <kyoung () v-one com>]

Kevin Brown wrote:
> Then (if snort doesn't have this already) maybe snort should be used in 
> non-promiscuous mode if it is run from the firewall because all the 
> traffic destined for your network has to go through the firewall.

Good point.

However you will still need to run another copy of Snort for your inside 
network (for traffic that doesn't go through the firewall), right?

FYI, Snort does support non-promiscuous mode with the "-p" switch.

--

--
--Keith Young
-kyoung () v-one com




-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users