Snort mailing list archives
Re: Monitoring techniques on switch
From: "Simon Gray" <simong () desktop-guardian com>
Date: Mon, 7 Jul 2003 13:59:01 +0100
cheap and dirty method is to use a hub on the segment you wish to monitor for example we use to have internet connection -> hub -> switch off the hub we'd have an sensor listening and logging to a seperate network. Not the best solutions but better than nothing (and easy to implement) Simon ----- Original Message ----- From: "Always Bishan" <bishan4u () yahoo co uk> To: <snort-users () lists sourceforge net> Sent: Monday, July 07, 2003 1:03 PM Subject: [Snort-users] Monitoring techniques on switch
Hi How can we make a snort sensor monitor traffic on a switch? Switch doesnot have a port mirror. Nor do we have taps. One solution that I can think of is arpspoofing, redirecting and routing all the traffic from the snort sensor. Any ideas, clues, comments most welcome! Regards, Bishan ________________________________________________________________________ Want to chat instantly with your online friends? Get the FREE Yahoo! Messenger http://uk.messenger.yahoo.com/ ------------------------------------------------------- This SF.Net email sponsored by: Free pre-built ASP.NET sites including Data Reports, E-commerce, Portals, and Forums are available now. Download today and enter to win an XBOX or Visual Studio .NET. http://aspnet.click-url.com/go/psa00100006ave/direct;at.asp_061203_01/01 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
------------------------------------------------------- This SF.Net email sponsored by: Free pre-built ASP.NET sites including Data Reports, E-commerce, Portals, and Forums are available now. Download today and enter to win an XBOX or Visual Studio .NET. http://aspnet.click-url.com/go/psa00100006ave/direct;at.asp_061203_01/01 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Monitoring techniques on switch Always Bishan (Jul 07)
- Re: Monitoring techniques on switch Simon Gray (Jul 07)