Software TAP
Hi fellow Debian users,
I am currently researching the many setups of snort. I am after advice
on the most practical tap setup to get the most out of snort. The ideas
that have currently been presented to me are as follows:
- Hub between router (pri internet connection) and 1st main
switch(collisions are a concern with this)
- Using the SPAN port if my switch has it (un-sure at present)
- Or build a Debian solution and configuring the network cards in
bridged mode
- Hardware tap
What are the best ideas for a tap? Are any of the above suitable
solutions for a tap? My network is under medium traffic, serving around
10 websites and 20 email accounts, across 2 servers currently, will be
expanding to 4 in the near future(waiting on second net connection).
1gig average daily bandwidth.
Kind regards,
Julian De Marchi
Reply to: