TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message to [EMAIL PROTECTED] Contact [EMAIL PROTECTED] for help with any problems! ----------------------------------------------------------------------------
Another option that you could have is to get a switch capable of mirroring your network traffic. I use a toplayer switch, which not only allow me to mirror the traffic, but also the ability to selectively mirror the type of traffic I want to see. By the way, I definitely would not use your sensor as a sniffer, as there is no "direct" indicator of it dropping packets. I use a linux workstation and run tcpdump on the mirror port. Vincent Tan [GCFW, MCSE, CNE, CIP] Security Engineer Analysts International, Inc. -----Original Message----- From: Fitch, Brian (ISS Atlanta) [mailto:[EMAIL PROTECTED]] Sent: Monday, July 29, 2002 9:17 PM To: 'Rodel Calvario'; [EMAIL PROTECTED] Subject: RE: Network Sensor and Sniffer TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message to [EMAIL PROTECTED] Contact [EMAIL PROTECTED] for help with any problems! ---------------------------------------------------------------------------- RealSecure 7.0 gives you the ability to run a full packet capture mode by the sensor itself if you choose. However, this would definitely degrade the sensor performance. If you're running RS 7.0 on a fully utilized 100Mbps network segment this is not advisable. If you're running at considerably under full utilization, this could be an option you might think of exploring. Brian Fitch Systems Engineer Internet Security Systems, Inc. -----Original Message----- From: Rodel Calvario [mailto:[EMAIL PROTECTED]] Sent: Monday, July 29, 2002 4:31 PM To: [EMAIL PROTECTED] Subject: Network Sensor and Sniffer TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message to [EMAIL PROTECTED] Contact [EMAIL PROTECTED] for help with any problems! ---------------------------------------------------------------------------- Hi All, I am currently maintaining a couple of network sensors with 2 nics. The monitoring interface is configured in stealth mode. My question is, I want to install a sniffer on my network sensor but am afraid that this would degrade the performance of my sensor. Is there anyone in this list tried to do this already? Please let me know how it was setup. Any help is welcome. Thanks, Rodel _________________________________________________________________ Chat with friends online, try MSN Messenger: http://messenger.msn.com
