I am just setting up Snort in an environment with ~500 computers.
I am monitoring 5 servers and our WAN port.
2 of the servers only have one NIC installed.
1 Server has 3 NICs installed
2 Servers have 2 NICs installed
If I monitor only one port on each machine Snort does not drop any packets.
If I monitor more than one NIC on the servers that have multiple NICs, I
seem to drop a huge amount of packets (at least 30%).
The switches we are using are HP Procurve 4000's. When I add the multiple
NICs to monitor I get a warning that broadcast messages can be duplicated
on the monitoring port. It only happens when I add the NICs that are on
the same machine to the monitoring list. If I add each server but only one
NIC from each server I do not run into the waring message.
Because of limited funds and other issues we are currently doing routing
with the servers and it is not hardware based routing.
The command line that I am using is: snort -v
Any ideas as to why this might be happening? Hopefully I have provided
enough info!
Thanks,
Adam Cavaliere
-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://productguide.itmanagersjournal.com/
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
