Results 1 to 4 of 4

Thread: snort

  1. February 26th, 2003, 03:35 AM #1
    linuxcomando
    linuxcomando is offline
    Senior Member linuxcomando's Avatar
    Join Date
    Sep 2001
    Posts
    432

    snort

    How does snort work in a switched network? What are some good ways to set up snort on a network that uses multiple switches and has several subnets.
    Reply With Quote Reply With Quote
  2. February 26th, 2003, 05:36 AM #2
    ammo
    ammo is offline
    Senior Member
    Join Date
    Sep 2001
    Posts
    1,027
    It doesn't really unfortunately...

    Possibilities are pretty much limited to using port mirroring (SPAN ports), "splicing in" on an uplink/trunk with a hub...

    Ammo
    Credit travels up, blame travels down -- The Boss
    Reply With Quote Reply With Quote
  3. February 26th, 2003, 05:24 PM #3
    linuxcomando
    linuxcomando is offline
    Senior Member linuxcomando's Avatar
    Join Date
    Sep 2001
    Posts
    432
    hmm, then is there any good IDS software that will work in a switched enviornment?
    Reply With Quote Reply With Quote
  4. February 26th, 2003, 05:35 PM #4
    ammo
    ammo is offline
    Senior Member
    Join Date
    Sep 2001
    Posts
    1,027
    Well, it's more a limitation of the concept of NIDS vs switching...
    Only *true* solution is to have the IDS integrated to the switch, like on some cisco catalysts...

    Ammo
    Credit travels up, blame travels down -- The Boss
    Reply With Quote Reply With Quote
« Previous Thread | Next Thread »

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  

Forum Rules