Re: Multiple network segment monitor with Snort

[Sergio Pozo Hidalgo <blitter_es () yahoo es>]

I know that. But Cisco routers are very expensive. I was looking for 
cheaper solutions. My first desing used a Layer3 switch, but then I 
changed my mind (because of an impossibility for my netscreen border 
router to define more than two zones), and used a cheaper design (but I 
think that also less secure and manageable) with no Layer3 switch, but 
two Layer2 ones. Do you know any cheap Layer2 or Layer3 switch with 
mirror ports?

Thank you.

James Williams wrote:

> If the box is connected to a cisco switch you can setup a port to
> monitor as many, or as few vlans as you want and send that traffic to
> the port that your snort box is connected to. 



---------------------------------------------------------------------------
Captus Networks IPS 4000
Intrusion Prevention and Traffic Shaping Technology to: 
- Instantly Stop DoS/DDoS Attacks, Worms & Port Scans
- Automatically Control P2P, IM and Spam Traffic
- Precisely Define and Implement Network Security & Performance Policies
FREE Vulnerability Assessment Toolkit - WhitePapers - Live Demo 
http://www.securityfocus.com/sponsor/CaptusNetworks_focus-ids_000101
---------------------------------------------------------------------------