Re: About to setup snort

["Shaun T. Erickson" <ste () smxy org>]

Truax, Shawn (MBS) wrote:

> You might run into some issues with those HUBs.  Depending on the amount of
> traffic you have on your network you may run into some heavy collision
> situations.  Before you go all crazy and install the whole solution I would
> put in one of the HUBs and see how things run for a day or so.  If users
> start calling up complaining about performance or connectivity you may have
> to invest in some taps or switchs that have span ports.  Another option for
> you may be the  Do-It-Yourself Tap instructions on the Snort Website.  If
> you have trouble with the Hubs try those.  I wouldn't recommend them for
> high traffic areas but they may be good enough for you and get you somewhere
> that is better than a HUB but cheaper then the new switches.

James Edwards wrote:
>
> Well, yuck. Test this. Once a local host gets an infection
> that makes a lot of traffic you will see why this is a bad idea.

I understand that the hubs are a sub-optimal solution, but I'm told we 
simply cannot afford anything else, at the moment. I'll look at the 
Do-It-Yourself Tap. Thankfully, though, we have very low traffic here.

        -ste


-------------------------------------------------------
This SF.Net email is sponsored by: Oracle 10g
Get certified on the hottest thing ever to hit the market... Oracle 10g. 
Take an Oracle 10g class now, and we'll give you the exam FREE.
http://ads.osdn.com/?ad_id=3149&alloc_id=8166&op=click
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users