Question about Snort sensor placement
Erm my network looks like this:
|Internal hosts|--|switch|---|OpenBSD firwall|-----|switch|---|border router|
My servers are attached to the switch, that is attached to the border router. I would very much like to use snort on OpenBSD. I have one spare machine(for loghost and/or snort sensor).
Am i right in thinking that my only option, to monitor my servers at little extra cost, is to attach a hub to the switch that my servers are attached to, then attach the snort box and the servers to this hub?
There are no other low cost solutions, correct?
Thank you very much for any advice
|Thread||Thread Starter||Forum||Replies||Last Post|
|Intrusion detector Snort now has improved HTTP inspection||J65nko||News||0||28th April 2010 12:29 AM|
|PF + SNORT on one machine||WeakSauceIII||OpenBSD Security||5||30th July 2009 10:02 AM|
|external drive partition question + fdisk question||gosha||OpenBSD General||15||15th June 2009 03:00 PM|
|snort install error||ijk||FreeBSD Installation and Upgrading||1||11th August 2008 11:53 AM|
|FreeBSD 7 and AMD CPU sensor||Oliver_H||FreeBSD General||1||20th May 2008 06:20 PM|