[Snort-users] Snort on Cisco 6509

Network Intern nsintern at ...12363...
Mon Aug 30 11:36:25 EDT 2004

Hi Everyone,

We have SNORT 2.0.2 running on Red Hat Linux release 9 (Shrike). We are monitoring the traffic that enters and exits our PIX firewall. Snort was up and running very well, until we had to make some network changes. Initially snort was connected to a Cisco 35xx series switch and was spanning (port monitoring) the interface connected to our firewall.

Currently we have connected the firewall directly to a Giga bit interface on our core switch (Cisco 6509) and hence we had to shift the location of snort to be connected directly to a 100 Mbit connection on the 6509. Currenlty we have set spanning on the 6509's 100 Mbit connection, to which snort is connected to monitor the Giga bit connection that is connected to the firewall.

However SNORT is not able to detect any alerts other than those to its own interface. So if we were to scan snort it would show up, but if we tried to scan the firewall it would not show up. The IP address of Snort is the same as the 100Mbit port on the 6509 is put on the Vlan that snort was configured. I noticed that the NIC was not in promiscuous mode so I set it to be in promiscuous mode. 

The output of the show span from the 6509 is
CJ_6509> (enable) show span

Destination     : Port 3/8
Admin Source    : Port 7/15
Oper Source     : Port 7/15
Direction       : transmit/receive
Incoming Packets: enabled
Learning        : enabled
Multicast       : disabled
Filter          : -
Status          : active

Total local span sessions:  1  

It would be of great help if you would kindly drop in some suggestions
Thanks a lot
Sherly Abraham
nsintern at ...12363...
Network Services
Hamilton College

More information about the Snort-users mailing list