RE: Passive Tap Help

[Frank Knobbe <frank () knobbe us>]

On Mon, 2003-12-01 at 11:49, Frank Knobbe wrote:
>  It is
> possible to use a second NIC and have two pcaps running and the IDS
> reassembling the data itself. Or you can have two NICs set up as a
> bonded/joined interface where the OS does the reassembling and a single
> instance of pcap and IDS runs over the traffic.

The third solution is to configure two interfaces in a Bridge
configuration and sniff on one of the interfaces.

(This is close to the bonded interface except that the bonded interface
appears as a single interface.)

-Frank

Attachment: signature.asc
Description: This is a digitally signed message part