Re: [Snort-users] Snort in VMware

Err,

Not all hubs mirror "repeat" all traffic to all ports.

Ever heard of an itelligent hub ?

M



Quoting "M. Morgan" <mikemorgan@mindspring.com>:

> Yeah, I thought that was obvious enough.
>=20
> -----Original Message-----
> From: Jeff <jcoppock1@comcast.net>
> Sent: Feb 18, 2004 7:48 PM
> To: snort-users@lists.sourceforge.net
> Subject: Re: [Snort-users] Snort in VMware
>=20
> M. Morgan, 2004-Feb-18 14:49 -0500:
> >=20
> > You need to have snort plugged into a "spanned" or "mirrored" por=
t for
> it
> > to see all of the traffic on that hub/switch/router. You should be=
able
> to
> > use "tcpdump" in Red Hat to get a look at the real time traffic on=
your
> > eth card.
>=20
> Actually, you would need a mirrored port on a switch since switches
> bridge between ports, and a router since routers either bridge or
> route between ports. But, mirroring is not done on hubs since hubs
> repeat all traffic to every port.
>=20
> Just a minor knitpick clarification...jc
>=20
> --=20
> Jeff Coppock Systems Engineer
> Diggin' Debian Admin and User
>=20
>=20
> -------------------------------------------------------
> SF.Net is sponsored by: Speed Start Your Linux Apps Now.
> Build and deploy apps & Web services for Linux with
> a free DVD software kit from IBM. Click Now!
> http://ads.osdn.com/?ad_id=3D1356&al...438&op=3Dclick
> _______________________________________________
> Snort-users mailing list
> Snort-users@lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/...fo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.p...=3Dsnort-users
>=20
>=20
>=20
> -------------------------------------------------------
> SF.Net is sponsored by: Speed Start Your Linux Apps Now.
> Build and deploy apps & Web services for Linux with
> a free DVD software kit from IBM. Click Now!
> http://ads.osdn.com/?ad_id=3D1356&al...438&op=3Dclick
> _______________________________________________
> Snort-users mailing list
> Snort-users@lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/...fo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.p...=3Dsnort-users
>=20





-------------------------------------------------------
SF.Net is sponsored by: Speed Start Your Linux Apps Now.
Build and deploy apps & Web services for Linux with
a free DVD software kit from IBM. Click Now!
http://ads.osdn.com/?ad_id=1356&alloc_id=3438&op=click
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/...fo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.p...st=snort-users