Re: snort placement

[neptuna <neptuna () neptuna org>]

On Sun, 2002-08-04 at 16:00, David Yip wrote:
> Hey guys, be realistic! It's just a home network. Forget about tap or port 
> mirroring, either install on the gateway or use a hub. No matter how cheap 
> the DLink is, it's still a switch, you'll need a hub. It won't hurt to use 
> a hub since your traffic will not exceed 10-20MB on a cable connection. In 
> my opinion, putting it on the internal segment should be a better solution 
> for your situation since it will save you a lot of time and concentrate 
> only on the critical alerts that have come into your network. Trust me, 
> there are a lot of scanning going on, and you won't want to see thaem all, 
> let the firewall do its job.


Yes it is just a home network but I am interested in simulating a more Real 
world environment. Maybe for now I can use a hub and place snort on one
of the internal boxes like you suggested. In the future go with other
options
Thanks




-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users