<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto"><div>You should try the dd-wrt forums. This isn't about Snort.  <br><br>--<div>Joel Esler</div><div>Sent from my iPhone</div></div><div><br>On Apr 4, 2014, at 14:13, "Teo En Ming" <<a href="mailto:teo.en.ming@...11827...">teo.en.ming@...11827...</a>> wrote:<br><br></div><blockquote type="cite"><div>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
  
  
    <div class="moz-cite-prefix">My Asus RT-N15U wireless router is not
      supported on OpenWRT. Only the RT-N15 model is supported.<br>
      <br>
      According to your reply, you have no hope of getting port
      mirroring to work with my Buffalo WZR-HP-G300NH2 wireless router
      at all?<br>
      <br>
      Sob sob sob. I wasted my money.<br>
      <br>
      <pre class="moz-signature" cols="72">-- 
Yours sincerely,

Teo En Ming
</pre>
      <br>
      <br>
      On 05/04/2014 02:02, Bill Parker wrote:<br>
    </div>
    <blockquote cite="mid:CAFrbyQxxnq6B1M=qr8=kvtsLyw+pZzBg_1jAxdiPoAhYJAqKQg@...11828..." type="cite">
      <div dir="ltr">
        <div>
          <div>
            <div>You could try OpenWRT, which does support mirroring. 
              Another method would be to put in a intelligent switch for
              all hardware on your network which would give you the same
              thing as a SPAN/mirror port.<br>
              <br>
            </div>
            I have NOT tried the OpenWRT firmware, so I would exercise
            caution with changing the DD-WRT firmware to OpenWRT, but if
            you still have your ASUS router, it might handle the OpenWRT
            firmware just fine.<br>
            <br>
          </div>
          <a moz-do-not-send="true" href="http://wiki.wireshark.org/SwitchReference">http://wiki.wireshark.org/SwitchReference</a><br>
          <br>
        </div>
        The above link is for switches which support mirroring/span
        (with some links to low cost solutions).<br>
        <br>
        It would be nice if Buffalo/Asus and other router providers have
        a SPAN/mirror port built in, but that's the problem with
        consumer routers (unfortunately).<br>
        <br>
        Bill<br>
      </div>
      <div class="gmail_extra"><br>
        <br>
        <div class="gmail_quote">On Fri, Apr 4, 2014 at 8:23 AM, Teo En
          Ming <span dir="ltr"><<a moz-do-not-send="true" href="mailto:teo.en.ming@...11827..." target="_blank">teo.en.ming@...11827...</a>></span>
          wrote:<br>
          <blockquote class="gmail_quote" style="margin:0 0 0
            .8ex;border-left:1px #ccc solid;padding-left:1ex">
            <div text="#000000" bgcolor="#FFFFFF"> Hi,<br>
              <br>
              I am extremely disappointed. I spent SGD$109 on the
              Buffalo WZR-HP-G300NH2 wireless router but can't get port
              mirroring to work.<br>
              <br>
              I have tested the following 2 iptables commands with *all*
              of the DD-WRT v24-SP2 firmware builds/versions from the
              year 2011 to the year 2014 but still cannot get port
              mirroring to work.<br>
              <br>
              # iptables -A PREROUTING -t mangle -j ROUTE --gw
              192.168.1.40 --tee<br>
              <br>
              # iptables -A POSTROUTING -t mangle -j ROUTE --gw
              192.168.1.40 --tee<br>
              <br>
              I bought my Buffalo DD-WRT router according to the
              recommendations in <a moz-do-not-send="true" href="http://www.snort.org/docs" target="_blank">http://www.snort.org/docs</a>
              (Bill/William Parker's <a moz-do-not-send="true" href="http://s3.amazonaws.com/snort-org/www/assets/217/Mirror_Traffic_With_Home_Router.pdf" target="_blank">How to make some Home Routers mirror
                traffic to Snort</a> article) but I can't get port
              mirroring to work. Apparently *all* of the DD-WRT v24-SP2
              firmware builds/versions between 2011 and 2014 don't
              support the route target and tee.<br>
              <br>
              What are my options now? I couldn't return the Buffalo
              DD-WRT router to the distributor in Singapore and ask for
              a refund. <br>
              <br>
              Are there any other firmware builds/versions which I can
              try to get port mirroring to work? I have also filed a bug
              report with <a moz-do-not-send="true" href="http://www.dd-wrt.com" target="_blank">http://www.dd-wrt.com</a>.
              The bug report is here: <a moz-do-not-send="true" href="http://www.dd-wrt.com/dd-wrtv2/bugtracker/view.php?id=4522" target="_blank">http://www.dd-wrt.com/dd-wrtv2/bugtracker/view.php?id=4522</a><br>
              <br>
              I have also reported the issue on the DD-WRT forum but
              nobody is replying to my thread. <a moz-do-not-send="true" href="http://www.dd-wrt.com/phpBB2/viewtopic.php?t=260012" target="_blank">http://www.dd-wrt.com/phpBB2/viewtopic.php?t=260012</a><br>
              <br>
              I also joined DD-WRT IRC channel on freenode but nobody is
              replying to my questions.<br>
              <br>
              *Sob sob sob sob sob sob*<br>
              <br>
              What should I do? Please advise.<span class="HOEnZb"><font color="#888888"><br>
                  <pre cols="72">-- 
Yours sincerely,

Teo En Ming

</pre>
                </font></span></div>
          </blockquote>
        </div>
        <br>
      </div>
    </blockquote>
    <br>
    <br>
    <pre class="moz-signature" cols="72"></pre>
  

</div></blockquote><blockquote type="cite"><div><span>------------------------------------------------------------------------------</span><br></div></blockquote><blockquote type="cite"><div><span>_______________________________________________</span><br><span>Snort-users mailing list</span><br><span><a href="mailto:Snort-users@lists.sourceforge.net">Snort-users@lists.sourceforge.net</a></span><br><span>Go to this URL to change user options or unsubscribe:</span><br><span><a href="https://lists.sourceforge.net/lists/listinfo/snort-users">https://lists.sourceforge.net/lists/listinfo/snort-users</a></span><br><span>Snort-users list archive:</span><br><span><a href="http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users">http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users</a></span><br><span></span><br><span>Please visit <a href="http://blog.snort.org">http://blog.snort.org</a> to stay current on all the latest Snort news!</span></div></blockquote></body></html>