[Snort-users] Setting up Snort with router span port

Y M snort at ...15979...
Tue Feb 4 04:08:27 EST 2014

Hi Michael,
Can you please further elaborate on "not seeing all the traffic"? Do you mean that Snort is partially seeing the traffic or not seeing the traffic at all? If you run tcpdump on the machine receiving the traffic from the span port, do you get any packets?
Date: Mon, 3 Feb 2014 10:20:56 -0500
From: mike.a.brown09 at ...11827...
To: snort-users at lists.sourceforge.net
Subject: [Snort-users] Setting up Snort with router span port

Hey guys. I did have snort working with a hub but decided to take that out because it was slowing down my network. I have a WRT160 Router and want to have a span port. I know the commands to do this but it seems like Snort is not seeing all the traffic. All traffic is going to the IP address associated with my eth0 interface. Any one have any hints?

Thank you, 

Michael A. Brown
mike.a.brown09 at ...11827...
M.S. Forensic Studies: Computer Forensics

B.S. Information Technology: Network Specialist

"The only thing necessary for the triumph of evil is for good men to do nothing" -Edmund Burke

Managing the Performance of Cloud-Based Applications
Take advantage of what the Cloud has to offer - Avoid Common Pitfalls.
Read the Whitepaper.
Snort-users mailing list
Snort-users at lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
Snort-users list archive:

Please visit http://blog.snort.org to stay current on all the latest Snort news! 		 	   		  
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20140204/bf955752/attachment.html>

More information about the Snort-users mailing list