[Snort-users] Cisco Switch Question
tparker at ...3825...
Tue Oct 16 02:54:10 EDT 2001
Thanks everyone for the help! I appreciate it.
From: Chris Schuler [mailto:cschuler at ...2467...]
Sent: Monday, October 15, 2001 8:17 PM
To: Tim Parker
Subject: Re: [Snort-users] Cisco Switch Question
you will need to set the port the snort machine is plugged into into a
int f0/# (#=port #)
switchport monitor 1-24 (or you can give it a vlan # )
this will cause all traffic from the defince ports, or vlan to be mirrored
to that port..thus letting the snort box see all traffic
if ya get in trouble do a '?'
----- Original Message -----
From: "Tim Parker" <tparker at ...3825...>
To: <snort-users at lists.sourceforge.net>
Sent: Monday, October 15, 2001 8:11 PM
Subject: [Snort-users] Cisco Switch Question
> I just set up an NT monitoring station at home on my small network and I
> have it plugged into a Linksys 10/100 Switch. At work I have both a
> 8.0 system and an NT box with Snort 1.8, these are both plugged into a
> 2912 on my desk. I am not getting any alerts from the two units at work.
> What do I need to do differently? I just want them to monitor the subnet
> they are on now for testing. Eventually (after a learn a bit more!) I am
> going to be setting up a unit to monitor a DMZ and a web site. Thanks for
> any pointers.....
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> Snort-users list archive:
More information about the Snort-users