TABLE OF CONTENTS You can make effective use of Snort by simply building and installing the stock source code and using the generic ruleset. However, if you are willing to write custom rules or write specialized plug-ins for augmenting preprocessing, detection, or postprocessing, then a new universe of possible uses presents itself We will look at some of these possibilities by looking at various security requirements and how they might be implemented.
First let's look at just what these enhancing elements are and what kinds of things that they can do for us.
There is always an issue on how to actually get monitored packets physically into Snort. With a network hub, its just a matter of hooking it up to the Ethernet interface that you intend to use as Snorts monitor port. These days, hubs are found on only very small networks that do not have that much traffic on them. The real problem is what to do for a switched network. The question on how to monitor a switched network is one of the official Snort FAQs.
The answer depends on the type of switch you have, the capabilities of your Snort system, and how large your budget is. If you have a managed switch, you can usually put it into a mode where all traffic that crosses the switch can also be mirrored onto one of the switch ports (which is where you connect the Snort monitor interface). This configuration is called SPAN for Cisco switches;
