Re: Snort sensor placement

From: Florin Andrei (florin@sgi.com)
Date: 09/28/01 

Subject: Re: Snort sensor placement
From: Florin Andrei <florin@sgi.com>
To: focus-ids@securityfocus.com
Date: 27 Sep 2001 15:24:55 -0700
Message-Id: <1001629495.3565.29.camel@stantz.corp.sgi.com>

On Thu, 2001-09-27 at 09:39, Rui Lapa wrote:
> Ever heard of receive only cables?
>
> http://personal.ie.cuhk.edu.hk/~msng0/sniffing_cable/

But, isn't this functionally identical to running the sensor on an
interface without an IP address?
If you activate the interface, but don't assign an IP address, Snort is
still able to run, but no IP connection could be made. It's the same
thing as with RO-cables, but simpler. 

-- 
Florin Andrei

"This is a Klingon." "Where did it came from?" "Oklahoma."
(from Star Trek Enterprise series premiere)