Snort mailing list archives

Passive Ether Tap

From: "Matt Nelson" <mnelson () nels-sec com>
Date: Sat, 17 Apr 2004 18:33:43 -0500

Hello all, I have made a passive ethernet tap.   What effect will this have
on my Snort analysis?  Will SNort be able to reassemble the both streams or
will using 2 NICs and separate Snort processes be needed?

Current thread:

Passive Ether Tap Matt Nelson (Apr 16)
- <Possible follow-ups>
- FW: Passive Ether Tap Matt Nelson (Apr 16)