[Snort-users] Cisco Switch Question

Jim Howard Jim.Howard at ...2728...
Tue Oct 16 06:24:25 EDT 2001

It sounds like you need to enable SPAN on the ports that your snort machines
are plugged into.  Check your manual for the SPAN function.  Basically you
just tell the switch that a port should receive all the traffic that appears
on all ports.

-----Original Message-----
From: Tim Parker [mailto:tparker at ...3825...]
Sent: Monday, October 15, 2001 7:11 PM
To: snort-users at lists.sourceforge.net
Subject: [Snort-users] Cisco Switch Question

I just set up an NT monitoring station at home on my small network and I
have it plugged into a Linksys 10/100 Switch. At work I have both a Mandrake
8.0 system and an NT box with Snort 1.8, these are both plugged into a Cisco
2912 on my desk. I am not getting any alerts from the two units at work.
What do I need to do differently? I just want them to monitor the subnet
they are on now for testing. Eventually (after a learn a bit more!) I am
going to be setting up a unit to monitor a DMZ and a web site. Thanks for
any pointers.....

Snort-users mailing list
Snort-users at lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
Snort-users list archive:

More information about the Snort-users mailing list