Snort Deployment Configurations

[Michael Lubinski <michael.lubinski () gmail com>]

I find myself thinking more and more in the realm of NSM and Snort. I have
been running different theoretical deployment situations in my head on how /
where I would deploy a snort sensor. I thought "Why don't I just ask the
people that work with it everyday." I would imagine running Snort on the
outside of your network would net a different set of rules being active as
would a Snort sensor running internally.

Does anyone run Snort in multiple locations with varied purposes like this
example?

Before I started to really dig into snort I always thought of it as a inline
gateway monitor / filter between you and the world, but the more I learn
that it can be much more universal depending on the rules included.

What other considerations might someone new to snort such as myself overlook
at first thought?

------------------------------------------------------------------------------
The modern datacenter depends on network connectivity to access resources
and provide services. The best practices for maximizing a physical server's
connectivity to a physical network are well understood - see how these
rules translate into the virtual world? 
http://p.sf.net/sfu/oracle-sfdevnlfb

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users