[Snort-users] Cisco Switch Question

Tim Parker tparker at ...3825...
Tue Oct 16 02:54:10 EDT 2001

Thanks everyone for the help! I appreciate it.


-----Original Message-----
From: Chris Schuler [mailto:cschuler at ...2467...]
Sent: Monday, October 15, 2001 8:17 PM
To: Tim Parker
Subject: Re: [Snort-users] Cisco Switch Question

you will need to set the port the snort machine is plugged into into a
monitor port
conf t
int f0/#  (#=port #)
switchport monitor 1-24 (or you can give it a vlan # )
wr me

this will cause all traffic from the defince ports, or vlan to be mirrored
to that port..thus letting the snort box see all traffic
if ya get in trouble do a  '?'

----- Original Message -----
From: "Tim Parker" <tparker at ...3825...>
To: <snort-users at lists.sourceforge.net>
Sent: Monday, October 15, 2001 8:11 PM
Subject: [Snort-users] Cisco Switch Question

> I just set up an NT monitoring station at home on my small network and I
> have it plugged into a Linksys 10/100 Switch. At work I have both a
> 8.0 system and an NT box with Snort 1.8, these are both plugged into a
> 2912 on my desk. I am not getting any alerts from the two units at work.
> What do I need to do differently? I just want them to monitor the subnet
> they are on now for testing. Eventually (after a learn a bit more!) I am
> going to be setting up a unit to monitor a DMZ and a web site. Thanks for
> any pointers.....
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users

More information about the Snort-users mailing list