RE: Passive Snort Setup

["Gould, Scott" <scott.gould () gogstats org>]

Are you looking to do any blocking of traffic or will this simply be a detection device?

If you are not going to do any blocking, a tap might fit the bill nicely.

Best regards,

Scott

-----Original Message-----
From: listbounce () securityfocus com [mailto:listbounce () securityfocus com] On Behalf Of Daniel Hood
Sent: Friday, February 20, 2009 12:53 AM
To: security-basics () securityfocus com
Subject: Fwd: Passive Snort Setup

I think the Hogwash or snort_inline ideas look the best.

I want to manage it completely via BASE cause I am lazy and dont like
monitoring it any other way. If I used this same topology where would
I set up the webserver (which interface? and i know it would need an
ip) to run BASE? and would hogwash or snort_inline work? or would I
need a 3rd interface used for management?

Thanks,
Daniel