Re: [Snort-users] Span/Snoop ports...

Marc,

There are a few solutions:

1) Buy a TAP
http://www.netoptics.com <- One of many.

Hardware TAPS can be quite expensive. In some cases you may be better
off spending the money on a switch that has a span port.

2) Physically tap the line with a *nix box. For example you could have
two NICS just forwarding the traffic and tap into that. Latency
*might* be an issue depending on your setup. You can do some fancy
stuff with PF, for exampe dup to another (sensor) machine.

3) Build your own TAP.
http://www.snort.org/docs/tap <- Mileage may vary.


Good luck.

On Fri, 18 Mar 2005 08:31:19 -0500, Marc Hering <mhering@reval.com> wrote:
>
> Hey Guys,
> I just deployed a Snort box to one of our data centers...and I ran into a
> bit of a snafu. We have a 2948G-L3 switch and want to snort on it. The
> problem is that a L3 switch doesn't suppprt a snoop port...Has anyone found
> a way around this?
>
> Thanks!


On Fri, 18 Mar 2005 08:31:19 -0500, Marc Hering <mhering@reval.com> wrote:
>
> Hey Guys,
> I just deployed a Snort box to one of our data centers...and I ran into a
> bit of a snafu. We have a 2948G-L3 switch and want to snort on it. The
> problem is that a L3 switch doesn't suppprt a snoop port...Has anyone found
> a way around this?
>
> Thanks!


--
_________________
Paul Halliday
http://dp.penix.org

"Diplomacy is the art of saying "Nice doggie!" till you can find a rock."


-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/...fo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.p...st=snort-users