Ethical Hacking

Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package.
Computer Forensics Training at InfoSec Institute

Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors.




Network Security Snort-Users
[Top] [All Lists]

[Snort-users] Port Aggregator Tap alternatives for snort sensor

Subject: [Snort-users] Port Aggregator Tap alternatives for snort sensor
Date: Mon, 3 Mar 2008 18:55:53 -0500
I've been using a Cisco 2950 for single tap I have setup and it has
worked fine to date.

!
interface FastEthernet0/1
 switchport access vlan 100
 duplex full
!
interface FastEthernet0/2
 switchport access vlan 100
 duplex full
!
!
monitor session 1 source interface Fa0/1
monitor session 1 destination interface Fa0/3

Port one is the internet source, port two is to my routing device and
three is to my sensor.

I would like to setup some more taps without having to run more
switches. An alternative is to purchase a tap still (around $300) or
making one from scratch
(http://www.altsec.info/passive-network-tap.html) but I would prefer
not to have to deal with bonding interfaces. I was considering another
2950 switch (still cost around $250 used) but I figure there has got
to be a better solution? A port aggregator seems to be out of the
question since they seem to run around $1000...

Any recommendations? Thanks.

-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users

<Prev in Thread] Current Thread [Next in Thread>