RE: detecting a sniff application

[Rob Hughes <rob () robhughes com>]

On Tue, 2002-07-09 at 15:24, McCammon, Keith wrote:
> Read the FAQ...
>
> http://www.snort.org/docs/faq.html#1.8
>
> -----Original Message-----
> From: emil (needguide.com) [mailto:security () needguide com]
> Sent: Tuesday, July 09, 2002 4:15 PM
> To: 'Wissam Halawani'; snort-users () lists sourceforge net
> Subject: RE: [Snort-users] detecting a sniff application
>
>
> I was about to ask this question. Thanks Wissam.
> How will I be able to detect network intrusion in switch network?
>  
> Thanks.

You'll either need to plug the switch and the snort box into a hub in
order to detect traffic entering and leaving that segment, or plug the
snort box into a monitor (mirror, whatever your vendor calls it) port on
the switch to detect all traffic on that switch. 

-- 
Remember: the only difference between
being the champ and the chump is u.

Attachment: signature.asc
Description: This is a digitally signed message part