Re: Ethernet Taps

[Frank Knobbe <fknobbe () knobbeits com>]

On Sat, 2002-09-28 at 15:18, Gary Borgeson wrote:
> [...]
> Or connect the 2 mirror ports and a single NIC sensor to a hub (doesn't
> sound optimal)?

If the mirror ports are unbuffered (like most taps are), you will be
loosing packets due to collisions on the hub. You should connect the
taps to a switch instead and configure the switch such that you dedicate
a monitor port to receive packets from both input ports. Then connect
Snort to the monitor port.

Regards,
Frank

Attachment: signature.asc
Description: This is a digitally signed message part