Re: Ethernet Tap

[Frank Knobbe <frank () knobbe us>]

On Fri, 2004-08-13 at 13:31, STEVE MAKOUSKY wrote:
> If not is it easy enough to start snort on two nics and log to the
> same database and 
> handle packet reconstruction that way????

Uhm... no. Who would be doing the reconstruction? Snort isn't, the
database isn't.

Sorry, if you want to sniff a single data stream on two NICS
(split-tap), you would need to configure these NICs in bridge-mode, or
somehow else have the OS treat both NICs as a single NIC.

Regards,
Frank

Attachment: signature.asc
Description: This is a digitally signed message part