RE: One sensor for three switches

["Kreimendahl, Chad J" <Chad.Kreimendahl () umb com>]

You'll need one snort process (probably with its own config (such as dif
$HOME_NETs)... per each interface.

  _____  

From: Carlton L. Whitmore [mailto:cwhitmore () Advocacyinc org] 
Sent: Wednesday, July 28, 2004 4:48 PM
To: Kreimendahl, Chad J; snort-users () lists sourceforge net
Subject: RE: [Snort-users] One sensor for three switches



Do I need to relaunch snort to get it to recognize the other NIC cards?

 

 

  _____  

From: Kreimendahl, Chad J [mailto:Chad.Kreimendahl () umb com] 
Sent: Thursday, July 22, 2004 9:40 AM
To: snort-users () lists sourceforge net
Subject: RE: [Snort-users] One sensor for three switches

 

dual or quad interface NIC card.... or just additional NIC cards if
they'll fit.

 

  _____  

From: Carlton L. Whitmore [mailto:cwhitmore () Advocacyinc org] 
Sent: Wednesday, July 21, 2004 2:32 PM
To: snort-users () lists sourceforge net
Subject: [Snort-users] One sensor for three switches

I have port 3 on my Catalyst 2950 switches monitoring the ports on each
switch. Is there a way to have one port monitor the traffic on other
switches?

I really don't want to setup a sensor for every switch.

Carlton.