RE: Newbie Q on making it work

["Slighter, Tim" <tslighter () itc nrcs usda gov>]

Better yet, disable the IP'd interface on your snort system and then run
TCPDUMP on the stealth interface and see if it is picking up any type of
traffic.  

-----Original Message-----
From: twig les [mailto:twigles () yahoo com]
Sent: Tuesday, November 26, 2002 11:38 PM
To: Matt Kettler; Faber Fedor
Cc: snort-users () lists sourceforge net
Subject: Re: [Snort-users] Newbie Q on making it work


I'm too tired to check right now but if this hub
question isn't in the FAQ can someone put it in?  It
hits the list about once every 3 weeks.

--- Matt Kettler <mkettler () evi-inc com> wrote:
> Be specific about the hubs you are using.. Are they
> the auto-sensing type 
> like this one?
http://www.linksys.com/products/product.asp?grid=24&prid=148
> hint: a auto-sensing, or auto-bridging, hubs aren't
> really pure hubs, they 
> behave as if there was a switch between the 10mbit
> and the 100mbit part. 
> Pretty much any "hub" that has both 10 and 100mbit
> support and can support 
> both speeds at the same time MUST have some
> switching behavior, otherwise 
> you have a 10mbit hub.
>
> That said, what kinds of NICs are you using? What
> speeds are each of the 
> NICs operating at (10? 100?)
>
>
> As an example
>   I'm using that same model of hub you linked. The
> box surfing the net has 
> an intel 10/100 card operating at 100mbit, the
> linksys router operates at 
> 100mbit, the snort box has an old 3com 10mbit NIC in
> it.
>
> At 07:37 PM 11/26/2002 -0500, you wrote:
> >  Everything is plugged into one or more
> > Linksys hubs; no switches are invloved.
-------------------------------------------------------
> This SF.net email is sponsored by: Get the new Palm
> Tungsten T 
> handheld. Power & Color in a compact size! 
http://ads.sourceforge.net/cgi-bin/redirect.pl?palm0002en
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or
> unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users


=====
-----------------------------------------------------------
If you give a man a fish, he can eat for a day
If you bludgeon him to death, you can eat the fish yourself

-----------------------------------------------------------

__________________________________________________
Do you Yahoo!?
Yahoo! Mail Plus - Powerful. Affordable. Sign up now.
http://mailplus.yahoo.com


-------------------------------------------------------
This SF.net email is sponsored by: Get the new Palm Tungsten T 
handheld. Power & Color in a compact size! 
http://ads.sourceforge.net/cgi-bin/redirect.pl?palm0002en
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users


-------------------------------------------------------
This SF.net email is sponsored by: Get the new Palm Tungsten T 
handheld. Power & Color in a compact size! 
http://ads.sourceforge.net/cgi-bin/redirect.pl?palm0002en
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users