Re: snort placement

[Christopher Cook <crcook () oakland edu>]

you can put Snort where ever you would like it to be.

If I read correctly, this is your current setup

Cable Modem ----- Router/FW ---- Dlink switch ---- 3 computers.

Snort can be placed in many areas:  Probably the most beneficial would 
be in front and behind the router/FW, this way you know what you're 
being attacked with and what's getting through the FW.

CM ---- Snort --- Router/FW --- Snort ---- Switch ---- computers.

You can also hook it up to an open port on the switch and monitor 
traffic that way.  All these options are dependent on separate boxes 
doing Snort.

Chris Cook
Security and Support Specialist
Office of Information Technology
Oakland University


neptuna wrote:

> Hi
>
> I am new to snort. I have a simple home LAN, with a Cable modem and a
> linux box acting as a Router/ FW.  I have 3 machines on the inside. All
> are connected to a cheap little D-link switch. Is my only option to put
> snort on the Linux Router/FW ? 
> I have read the FAQ concerning this but i am still not sure. Any
> suggestions or pointers to more documentation is appreciated.
>
> Thanks
>
>
>
>
>
>
> -------------------------------------------------------
> This sf.net email is sponsored by:ThinkGeek
> Welcome to geek heaven.
> http://thinkgeek.com/sf
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users
>
>  





-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users