Mr. MailingLists wrote: > On 03/03/10 08:10, Raymond Norton wrote: >> I need to set up a box at our pop to sniff inbound and outbound traffic. >> I want to set it up as a passive device, or connect to a monitoring port >> on our switch, so if the box fails it does not kill our traffic. The >> device will need to be able to monitor thousands of connections without >> choking. I am pretty sure I would only turn it on when it seemed there >> was suspicious traffic at one of our member schools. Any recommendations >> of a stable solution with a nice interface?? >> >> Raymond >> > YAY a fun question!!! I used to keep a snort box around for sniffing, but not at this scale. Do you think it would be a good solution for my setup, as long as it meets the hardware specs?