+ Reply to Thread
Results 1 to 4 of 4

Thread: snort

  1. February 26th, 2003 02:35 AM #1
    linuxcomando
    linuxcomando is offline
    Senior Member linuxcomando is a glorious beacon of light linuxcomando is a glorious beacon of light linuxcomando is a glorious beacon of light linuxcomando is a glorious beacon of light linuxcomando is a glorious beacon of light linuxcomando's Avatar
    Join Date
    Sep 2001
    Posts
    430

    snort

    How does snort work in a switched network? What are some good ways to set up snort on a network that uses multiple switches and has several subnets.
    Reply With Quote Reply With Quote
  2. February 26th, 2003 04:36 AM #2
    ammo
    ammo is offline
    Senior Member ammo has a reputation beyond repute ammo has a reputation beyond repute ammo has a reputation beyond repute ammo has a reputation beyond repute ammo has a reputation beyond repute ammo has a reputation beyond repute ammo has a reputation beyond repute ammo has a reputation beyond repute ammo has a reputation beyond repute ammo has a reputation beyond repute ammo has a reputation beyond repute
    Join Date
    Sep 2001
    Posts
    1,027
    It doesn't really unfortunately...

    Possibilities are pretty much limited to using port mirroring (SPAN ports), "splicing in" on an uplink/trunk with a hub...

    Ammo
    Credit travels up, blame travels down -- The Boss
    Reply With Quote Reply With Quote
  3. February 26th, 2003 04:24 PM #3
    linuxcomando
    linuxcomando is offline
    Senior Member linuxcomando is a glorious beacon of light linuxcomando is a glorious beacon of light linuxcomando is a glorious beacon of light linuxcomando is a glorious beacon of light linuxcomando is a glorious beacon of light linuxcomando's Avatar
    Join Date
    Sep 2001
    Posts
    430
    hmm, then is there any good IDS software that will work in a switched enviornment?
    Reply With Quote Reply With Quote
  4. February 26th, 2003 04:35 PM #4
    ammo
    ammo is offline
    Senior Member ammo has a reputation beyond repute ammo has a reputation beyond repute ammo has a reputation beyond repute ammo has a reputation beyond repute ammo has a reputation beyond repute ammo has a reputation beyond repute ammo has a reputation beyond repute ammo has a reputation beyond repute ammo has a reputation beyond repute ammo has a reputation beyond repute ammo has a reputation beyond repute
    Join Date
    Sep 2001
    Posts
    1,027
    Well, it's more a limitation of the concept of NIDS vs switching...
    Only *true* solution is to have the IDS integrated to the switch, like on some cisco catalysts...

    Ammo
    Credit travels up, blame travels down -- The Boss
    Reply With Quote Reply With Quote
« Previous Thread | Next Thread »

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts

Forum Rules

 Security News

     Patches

       Security Trends

         How-To

           Buying Guides