Re: Snort and network taps

[Jason Haar <Jason.Haar () trimble co nz>]

On Tue, Apr 23, 2002 at 04:59:42PM -0700, Jeff Nathan wrote:
> Taps are designed to be used with analyzers.  The transmit pair from
> each side of a connection is broken out into it's own port.  These two
> tap ports then need to be recombined for snort.

Bizarre. I've snooped around via google - and the likes of some nice
drawings on www.sans.org totally fail to mention that "minor" point....

With the growth in the IDS arena, I'd say there's a market for an "IDS tap"
now - one where you are presented with one port containing both directions...

I thought of it first!!! I get copyright!!! ;-)

-- 
Cheers

Jason Haar

Information Security Manager
Trimble Navigation Ltd.
Phone: +64 3 9635 377 Fax: +64 3 9635 417

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users