We run SNORT in a Cisco environment with SPAN enabled so it duplicates our DMZ to an interface where our FreeBSD box is plugged in without an IP address. This works just fine for us and does not put a significant load on the switches. These are, however, 4507s and are monster machines.
<br><br>We have run SPAN on smaller switches (2900s and 2950s) without too much degradation in the performance. it just depends on how much traffic we are talking about.<br><br>jerry<br><br><div><span class="gmail_quote">
On 12/6/05, <b class="gmail_sendername">Jeff Davis</b> <<a href="mailto:jeff@dynamictelecard.com">jeff@dynamictelecard.com</a>> wrote:</span><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
I want to deploy an old box as a dedicated Snort machine.<br>I'm looking at ways to do that properly in a switched environment.<br> - Network Taps are expensive.<br> - Multispeed hubs (e.g. 10/100) are really a switch with a small ARP cache.
<br> Although it should still work, perhaps someone has done this and would<br> be willing to share their experience.<br> - SPAN / Port Mirroring / Roving Analysis, etc.<br> The 3com switches I have are capable of SPAN, but I'm a little concerned
<br> about degrading the performance of the switch with this approach.<br> If anyone has tried this approach I'd really like to know.<br><br><br>-Jeff<br><br><br><br><br><br>_______________________________________________
<br>Cialug mailing list<br><a href="mailto:Cialug@cialug.org">Cialug@cialug.org</a><br><a href="http://cialug.org/mailman/listinfo/cialug">http://cialug.org/mailman/listinfo/cialug</a><br></blockquote></div><br>