802.1q Monitoring

["Ron Shuck" <rshuck () Buchanan com>]

Hi,

Has anyone implemented or tried to monitor a 802.1q (trunked) connection
with Snort? I saw that DLink has a 802.1q compatible card, and that it
appears to be supported under Linux. I have several remote locations
that do not have a huge amount of traffic, but there are several VLANS.
It would be much easier and get the most coverage to port mirror/tap the
WAN connection, but it is trunked. 

Any help would be greatly appreciated.


Thanks,

Ron Shuck, CISSP, GCIA, CCSE - Managing Consultant 
Buchanan Associates - A Technology Company in the People Business 


-------------------------------------------------------
This SF.net email is sponsored by:  Etnus, makers of TotalView, The best
thread debugger on the planet. Designed with thread debugging features
you've never dreamed of, try TotalView 6 free at www.etnus.com.
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users