[Snort-users] Port Mirroring

Glenn Forbes Fleming Larratt glratt at ...604...
Thu Jan 30 19:03:01 EST 2003


I've never been peculiarly clear on 3Com's nomenclature, but we use
switch 1100's and 3300's (which come labelled superstack II or superstack 3,
depending on how new they are) - I think the CLI on the switches
labels the configuration you want "Analyzer", under the "Feature"
menu:

} Menu options: --------------3Com SuperStack II Switch 3300--------------
}  bridge             - Administer bridging/VLANS
}  ethernet           - Administer Ethernet ports
}  feature            - Administer system features
}  ip                 - Administer IP
}  logout             - Logout of the Command Line Interface
}  snmp               - Administer SNMP
}  system             - Administer system-level functions
}
} Type ? for help.
} -----------------------------------Switch 3300 (1)----------------------
} Select menu option: feature
}
} Menu options: --------------3Com SuperStack II Switch 3300--------------
}  analyzer           - Administer Roving Analysis
}  broadcastStormCont - Enable/Disable Broadcast Storm Control
}  resilience         - Administer resilient links
}  trunk              - Administer trunks
}
} Type "q" to return to the previous menu or ? for help.
} -----------------------------------Switch 3300 (1)----------------------
} Select menu option (feature): analyzer
}
} Menu options: --------------3Com SuperStack II Switch 3300--------------
}  add                - Configure the roving analysis port
}  display            - Display the Roving Analysis configuration
}  remove             - Clear the roving analysis port
}  start              - Start monitoring
}  stop               - Stop monitoring
}
} Type "q" to return to the previous menu or ? for help.
} -----------------------------------Switch 3300 (1)----------------------
} Select menu option (feature/analyzer): display
} Roving Analysis Configuration
}
} Monitor Port    Analysis Port   State
} none            none            Disabled



On Thu, 30 Jan 2003, Rich Adamson wrote:

> Date: Thu, 30 Jan 2003 20:35:09 -0600
> From: Rich Adamson <radamson at ...2127...>
> To: Bruno Benchimol a.k.a. Misty MSt <mistymst at ...8178...>,
>      snort-users at lists.sourceforge.net
> Subject: Re: [Snort-users] Port Mirroring
>
> > I've got a little problem here, i've got a 3com superstack II (10/100 mbits)
> > Switch.
> > i am running snort as a network intrusion detect system, but i couldnt do
> > port morrioring so its just a host IDS.
>
> Check your current installed software version for the specific model of
> switch installed, against the current upgrade version. Some models
> included mirroring in later versions while other models did not. There
> is at least some probability an upgrade may support mirroring.
>
>
>
>
> -------------------------------------------------------
> This SF.NET email is sponsored by:
> SourceForge Enterprise Edition + IBM + LinuxWorld = Something 2 See!
> http://www.vasoftware.com
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users
>

				Glenn Forbes Fleming Larratt
				Rice University Network Management
				glratt at ...604...





More information about the Snort-users mailing list