[Snort-users] setting up a mirroring port at switch
d_greenjr at ...125...
Sat Apr 26 06:01:04 EDT 2003
It would help to know which type of switch you have. On some of the larger
cisco switches you need to type the command "set span <src_prt> <dst_prt>".
On some of the smaller cisco switches you have to 1) configure the terminal
[config t], 2)select the destination interface [interface fa0/48], 3) select
the source interface to be monitored [port mirror fa0/12], 4) Ctrl-Z.
NOTE: All this is done after you have entered the exec priv mode.
DISCLAIMER: The syntax for the smaller cisco switch may be off on step three
so type "port mirr" and press the tab key for auto-completion.
----- Original Message -----
From: "smitha rao" <meetsmithahv at ...131...>
To: <snort-users at lists.sourceforge.net>
Sent: Saturday, April 26, 2003 6:36 AM
Subject: [Snort-users] setting up a mirroring port at switch
> hi all,
> I am testing snort in a machine which is connected to
> a star topology LAN.My m/c is an end m/c ,to which all
> the network traffic will not be redirected...I want my
> snort to test all the traffic.I dont want to test it
> on firewall m/c as it'll be similar as my nsort is
> running outside the firewall..resulting in unwanted
> I wanted to setup a mirroring port..How to set it up?
> so that all traffic comes to my m/c..Do anybody have a
> procedure to setup mirroring port at the switch level.
> plz help me..
> thank you
> Do you Yahoo!?
> The New Yahoo! Search - Faster. Easier. Bingo.
> This sf.net email is sponsored by:ThinkGeek
> Welcome to geek heaven.
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> Snort-users list archive:
More information about the Snort-users