Re: Snort sensor placement

From: Jose Nazario (jose@biocserver.BIOC.cwru.edu)
Date: 09/21/01 

Date: Fri, 21 Sep 2001 12:52:23 -0400 (EDT)
From: Jose Nazario <jose@biocserver.BIOC.cwru.edu>
To: Stuart Staniford <stuart@silicondefense.com>
Subject: Re: Snort sensor placement
Message-ID: <Pine.LNX.4.30.0109211251530.766-100000@biocserver.BIOC.CWRU.Edu>

On Fri, 21 Sep 2001, Stuart Staniford wrote:

> That is a simple solution that should work (and is probably favorite
> if you already have the hub lying around).

ISTR that one should use a switch if possible (with a reflector or
spanning port) rather than a hub for performance reasons.

____________________________
jose nazario jose@cwru.edu
                           PGP: 89 B0 81 DA 5B FD 7E 00 99 C3 B2 CD 48 A0 07 80
                                       PGP key ID 0xFD37F4E5 (pgp.mit.edu)