AW: Taps

["Poppi, Sandro" <Sandro.Poppi () wacker com>]

I've been using linux' "channel bonding" feature with 100base tx and 100base
SX cards and snort. Worked without probs (as far as I remember ;) Simply
make snort listen on the bonded interface, reassemblation of the tap streams
is done by the kernel.
 
HTH,
Sandro
 


Been through the details on hubs and spanning. Not completely happy with
those options
 
What would be nice to know is how do you configure snort to use two
interfaces from a TAP.
Does the reassembly occur in the OS ( I have heard that OpenBSD can be
configured to perform this)
 
Does not seem to be any info on how this is accomplished.
 
thanks
Paul Powenski