[Snort-users] Re: setting up a mirroring port at switch

smitha rao meetsmithahv at ...131...
Mon Apr 28 23:57:05 EDT 2003

Hi Shashank,
 Thanx , the information is really helpful...I was
using a IBM switch..but now i replaced it with hub..As
we are doing experimental project.. it helped me to
test snort.
 Now i am testing snort with prelude..I am using snort
as NIDS in prelude.
       Do u have any idea about the architecture of
snort, how it work?
 If u have any information plz... send me..That'll be
helpful to me.
                  Thank you
                             smitha h v
--- Shashank Bhide <shashank at ...9016...>
> Hi Smitha,
>       What sort of switch are you using? Is it an
> Extreme/Cisco/3Com 
> switch? I know how to get mirroring to work on
> extreme switches. Howerver, 
> it would not be difficult to do the same on either
> 3Com or Cisco. The Cisco 
> OS must have some configuration where you could
> mirror all the ports to one.
>     Also if you use snort with a subnet mask of the
> whole of your subnet 
> you should be able to catch all of the traffic that
> flows through your network.
> Hope this helps.
> Shashank
> Shashank Bhide
> Systems Administrator
> Biochemistry & Molecular Biology
> Oklahoma State University
> 405 744 7103 (Off)
> 405 744 7799 (Fax) 

Do you Yahoo!?
The New Yahoo! Search - Faster. Easier. Bingo.

More information about the Snort-users mailing list