Hi Duncan, On Fri, Apr 28, 2006 at 10:45:24AM -0500, Duncan Shannon wrote:
> Can I run pmacct on my (Fedora) system that is seeing all in/out traffic > (for snort) that is on a passive Ethernet tap? Just to fully agree with Sven's reply and to add that both Snort and pmacctd are libpcap-based: this means no conflicts (..apart from challenging for CPU cycles) if running together on the same box. Running pmacctd off a mirroring port on a promiscuous mode/no IP address interface perhaps is the most usual setup. Cheers, Paolo _______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
