Snort mailing list archives
Hardware/snort config question
From: "Richard Roy" <RoyR () justicetrax com>
Date: Wed, 23 Jul 2003 10:13:11 -0700
First of all, HUGE thanks to Patrick S. Harper for the doc to get snort going and some additional help! Second. I have a logistic question on how/where to put it and configure a few things to properly snort. I have a /16 of real IP addresses that are assigned to a hardware FW's external interface and NATted to the private internal 10's. The signal comes in from the ISP to a router then to a hub then to 2 different firewalls. One which has a single IP assigned to it for my wireless (separate network) and another that has the balance of the /16. The snort box is on the LAN which is all switched. How can I get all the stuff on the switch to be snorted? I'm thinking a port mirror or something right? Second, do I need to add a second NIC and attach to the HUB to see all the external traffic hitting the firewalls or not? My guess is yes or can I simply assign multiple IP's to the same nic (I'm running RH9) For the internal net I gave the snort box 192.168.100.0/24 to scan that's correct right (assuming it has an address of 192.168.100.x/255.255.255.0) For external I gave it the /16 range of real ip's I have. Thanks in advance. Please excuse this if it is "off-topic" and reply off list if you can help. Richard Roy Network Administrator JusticeTrax Inc 602-938-0059 x102 royr () justicetrax com
Current thread:
- Hardware/snort config question Richard Roy (Jul 23)
- <Possible follow-ups>
- Re: Hardware/snort config question Marc Quibell (Jul 23)