Snort will work in a switched environment, either configure the switch to mirror all traffic to the port the snort sensor is one, or do mac address spoofing. (the first one is the best solution)
On Tuesday 12 March 2002 06:53 am, Pavel Lozhkin wrote: > Hi ! > > Could one recommend me a IDS, such as snort, but designed for switched > network. > I looked at ettercap, but it does not fully meet my needs, i need > non-interactive IDS, not a collector, if the snort were working in > switched network environment, it would be enough for me. > > Thanks for any advise.
