[Snort-users] Re: What can Snort listen for (again)? (steven)

Ryan Hill rhill at ...2446...
Mon Oct 22 13:43:07 EDT 2001


Piotr,

Check with your switch vendor for instructions on setting this up - if you
have a lower-end switch that supports traffic mirroring (or you don't want
to place the load on the switch itself) you can also look into making an
ethernet tap that sits on the upstream link from your switch.

Cisco - Configuring Catalyst SPAN Ports
http://www.cisco.com/warp/public/473/41.html

For smaller Cisco switches that don't support the SPAN command set, you can
also use the port monitor command for the same functionality (2924XL's for
example).

Ethernet Taps Search:
http://www.google.com/search?q=ethernet+tap

Regards,

Ryan Hill, MCSE 
IT Ninja
Corporate Information Systems
Telecommunication Systems, Inc. (TCS) - http://www.telecomsys.com
v: 206.792.2276 - f: 206.792.2001
pgp: 0x17CE70AB


> -----Original Message-----
> From: Piotr Synowiec [mailto:mysiar at ...3887...] 
> Sent: Monday, October 22, 2001 1:09 PM
> To: Joe Pampel; SNORT LIST
> Subject: Re: [Snort-users] Re: What can Snort listen for 
> (again)? (steven)
> 
> 
> On Mon, 2001-10-22 at 21:42, Joe Pampel wrote:
> > 
> > If the hosts in question are plugged into the same hub as the snort 
> > sensor you're good to go. If you are running on a switch 
> you have to 
> > create a mirror port for snort (so it can see the traffic
> but how I can create this mirror port.
> I have got network with few switches in chain?
> 
> Rgds
> Piotr
> 
> 
> 
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe: 
> https://lists.sourceforge.net/lists/listinfo/s> nort-users
> 
> Snort-users list archive: 
> http://www.geocrawler.com/redir-sf.php3?list=snort-users
> 




More information about the Snort-users mailing list