[Snort-users] Cisco Switch Question
hostmaster at ...2310...
Tue Oct 16 04:32:12 EDT 2001
One other question that comes to mind, is this just for Cisco equipment? I
didn't do this at home on the Linksys and it works fine.
From: Tim Parker [mailto:tparker at ...3825...]
Sent: Tuesday, October 16, 2001 6:09 AM
To: snort-users at lists.sourceforge.net
Subject: RE: [Snort-users] Cisco Switch Question
Thanks everyone for the help! I appreciate it.
From: Chris Schuler [mailto:cschuler at ...2467...]
Sent: Monday, October 15, 2001 8:17 PM
To: Tim Parker
Subject: Re: [Snort-users] Cisco Switch Question
you will need to set the port the snort machine is plugged into into a
int f0/# (#=port #)
switchport monitor 1-24 (or you can give it a vlan # )
this will cause all traffic from the defince ports, or vlan to be mirrored
to that port..thus letting the snort box see all traffic
if ya get in trouble do a '?'
----- Original Message -----
From: "Tim Parker" <tparker at ...3825...>
To: <snort-users at lists.sourceforge.net>
Sent: Monday, October 15, 2001 8:11 PM
Subject: [Snort-users] Cisco Switch Question
> I just set up an NT monitoring station at home on my small network and I
> have it plugged into a Linksys 10/100 Switch. At work I have both a
> 8.0 system and an NT box with Snort 1.8, these are both plugged into a
> 2912 on my desk. I am not getting any alerts from the two units at work.
> What do I need to do differently? I just want them to monitor the subnet
> they are on now for testing. Eventually (after a learn a bit more!) I am
> going to be setting up a unit to monitor a DMZ and a web site. Thanks for
> any pointers.....
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> Snort-users list archive:
Snort-users mailing list
Snort-users at lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
Snort-users list archive:
More information about the Snort-users