Re: External snort monitoring

["George D. Nincehelser" <george () ccitriad net>]

By any chance is the Linksys router doing PPOE to your ISP?  If so, perhaps snort can't see into this link to your ISP.

The only other think I could think of is to make sure the Linksys is a hub and not a switch.

George
  ----- Original Message ----- 
  From: Larry E. Smith Jr. 
  To: Snort List (E-mail) ; Snort Users 
  Sent: Wednesday, August 08, 2001 10:12 AM
  Subject: [Snort-users] External snort monitoring


  I have my cable modem hooked into a Linksys 5 port hub and I also have a snort sensor configured on the hub to catch 
all traffic coming to my network. from the 5 port hub it connects into a Linksys router which is where my server is 
located. my question is why can i catch traffic on my internal snort sensor connected to the Linksys router, but all I 
can see are ARP requests on the external snort sensor which is connected to the hub? anyone have any ideas?