[Snort-users] Don't see traffic unless have IP

Jhumri Tilayia tilayia at ...125...
Sat May 18 10:34:02 EDT 2002


I am mirroring traffic on a Cisco switch to the port where the Snort box is 
hanging off of. The interface on the Snort box has no IP address. The 
problem is that Snort does not see any traffic if that interface does not 
have an IP assigned to it. As soon as I assign any random IP to it it works 
just fine.

Is it a known issue with Snort or does it sound like something to do with 
the switch (Cisco 6500) we are using ?

Also, is it possible to use a port that sees all the mirrored traffic as a 
source port (i.e. can I connect to the interface hanging off of that port ?)


Join the world�s largest e-mail service with MSN Hotmail. 

More information about the Snort-users mailing list