RE: I'm a snort virgin

["L. Christopher Luther" <CLuther () Xybernaut com>]

Check out these links:  

    http://www.snort.org/docs/snort-win2k.htm  
    http://www.snort.org/docs/iss-placement.pdf  
 
http://www.snort.org/docs/scott_c_sanchez_cissp-ids-zone-theory-diagram.pdf

    http://www.snort.org/docs/100Mb_tapping1.pdf  
    http://www.snort.org/docs/100Mb_tapping2.pdf  
    http://www.snort.org/docs/Gb_tapping.pdf  

They may give you some ideas. 

Without more details about your network, all I can give you is some
generalities.  The final answer depends on exactly how your various hubs are
inter-connected and what traffic you actually want to monitor.  


- Christopher 

-----Original Message-----
From: Angel Gabriel [mailto:badmangabriel () lycos co uk]
Sent: Tuesday, March 18, 2003 11:19 AM
To: snort-users () lists sourceforge net
Subject: [Snort-users] I'm a snort virgin


've been looking into snort, and I'd like to install it on it's own
dedicated 
box to monitor my network.
But, I have a slight problem, I have switched hubs, and it's my
understanding 
that not all data travels past all machines on a network with switched hubs.

Would this mean that I have to install multiple instances of snort on all
the 
diffrent segments of the network?? And if I did, is it possible to get them 
all to report to one file, or database??

-- 
*****
Not everyone is touched by an Angel...
... Those that are, never forget the experience
*****