Snort sensor placement

From: Brian Carvalho (brian.carvalho@verizon.net)
Date: 09/21/01 

Message-ID: <002d01c14232$03c7ac60$1993c7c6@herzog.com>
From: "Brian Carvalho" <brian.carvalho@verizon.net>
To: <focus-ids@securityfocus.com>
Subject: Snort sensor placement
Date: Thu, 20 Sep 2001 20:11:51 -0400

I'd like to use a dedicated machine running Snort to monitor
a server. I do not want to listen to all the traffic on the wire,
just the traffic hitting my host.

Should I connect the server and Snort box to its own hub
and then connect that hub where the server used to be?
This way the Snort box would only see the server..

Am I going about this the wrong way? Any other ways?

Relevant Pages

  • Re: Please Help - Strange problem with my servers - Locked out
    ... > The other server is directly connected to the Internet ... > I have a workstation on the WORK network. ... > The WORK network can talk to both HOME and COLO ... > Does snort drop packets? ...
    (comp.unix.bsd.freebsd.misc)
  • Re: Please Help - Strange problem with my servers - Locked out
    ... > The other server is directly connected to the Internet ... > I have a workstation on the WORK network. ... > The WORK network can talk to both HOME and COLO ... > Does snort drop packets? ...
    (comp.security.firewalls)
  • Re: Is snort an overkill for desktop only environment ?
    ... The answer to your question probably depends on what level of security ... One way to save money and management overhead with Snort might be to ... Another option is to install it on a small, ... Securing Apache Web Server with thawte Digital Certificate ...
    (Security-Basics)
  • RE: Any ideas?
    ... this time the first two Packets from Snort show the third part of the TCP ... because the attacker allready knows your server ... These are entries from my Snort IDS logs and my firewall logs for the IP ...
    (Security-Basics)
  • RE: Any ideas?
    ... this time the first two Packets from Snort show the third part of the TCP ... because the attacker allready knows your server ... These are entries from my Snort IDS logs and my firewall logs for the IP ...
    (Security-Basics)