Re: Snort in a switched environment

[Andrew.Zielinski () bedbath com]

If your switch allows it, you need to designate the port that Snort is
plugged into as a mirror port. This way all traffic on that switch is also
sent to the mirror port.

Andrew Zielinski


                                                                                                              
                    Bastian Ballmann                                                                          
                    <ballmann () co-de de>                  To:     snort-users () lists sourceforge net            
                    Sent by:                             cc:                                                  
                    snort-users-admin@lists.sourc        Subject:     [Snort-users] Snort in a switched       
                    eforge.net                           environment                                          
                                                                                                              
                                                                                                              
                    05/14/2002 11:19 AM                                                                       
                                                                                                              
                                                                                                              




Hello!
Is it possible to run Snort in a switched environment? Cause Snort can only

sniff the traffic of the host he is running on. Unless he is doing
something
like ARP poisoning or something like this...
But I think this would lead into trouble if you run the arpspoof
preprocessor
;)
Greets

Bastian Ballmann
--
Bastian Ballmann [ ballmann () co-de de ]
@ Computational Design GmbH
[ http://www.co-de.de ]

_______________________________________________________________

Have big pipes? SourceForge.net is looking for download mirrors. We supply
the hardware. You get the recognition. Email Us: bandwidth () sourceforge net
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users





_______________________________________________________________

Have big pipes? SourceForge.net is looking for download mirrors. We supply
the hardware. You get the recognition. Email Us: bandwidth () sourceforge net
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users