Ethernet Taps

[Gary Borgeson <gborgeson () aecc com>]

What is our favorite Ethernet tap? I'm also interested in how most folks
connect these devices to sensors. 

I'm looking at the NetOptics 10/100 Copper Tap and notice it has 4 ports.
Obviously 2 ports are for each side of the split, but I assume the other 2
ports are for mirroring the 2 sides. 

So, with this device and similar ones, do you connect the 2 mirror ports to
2 different NICs in your sensor? Then run 2 instances of Snort? How does
that affect logging? What about a dual-port NIC if you are out of slots?

Or connect the 2 mirror ports and a single NIC sensor to a hub (doesn't
sound optimal)?

Thanks, G

  


-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users