I have a need to set up a dedicated box running snort on an ATM WAN
between two university campuses. The box, a P300 running NetBSD, will
connect to a span port on an ATM switch. My purpose is to sample the
packets on the unfiltered side of the main router. The speed of the
connection is 155Mbps.

I'm interested in any info regarding ATM and NetBSD. And a source for
ENI/Adaptec ATM cards would be greatly appreciated.

I already have a NetBSD/i386 1.5_ALPHA box on the inside with a 3COM
3c905C-TX running at 100 Mbps connected to a span port on a Cisco switch.
The box is a P133 and it has been holding it's own:

Name  Mtu   Network       Address              Ipkts Ierrs    Opkts Oerrs Colls
ex0   1500  <Link>        00:50:da:c8:64:ba 1372882319     1    68720     0     
0
ex0   1500  204.228.67    snort.cusys.edu   1372882319     1    68720     0     
0
ex0   1500  fe80::        fe80::250:daff:fe 1372882319     1    68720     0     
0

It's been up for about five days. :-)

The inside box has been giving me good information that I've used to
add rules to the router access lists, but we want to keep tabs on
the "dirty" side of the network.
-- 
Rick Kelly  rmk@rmkhome.com  www.rmkhome.com