RE: Cisco Switch Question

["Tim Parker" <tparker () kennett net>]

Thanks everyone for the help! I appreciate it.

Tim


-----Original Message-----
From: Chris Schuler [mailto:cschuler () columbus rr com]
Sent: Monday, October 15, 2001 8:17 PM
To: Tim Parker
Subject: Re: [Snort-users] Cisco Switch Question


you will need to set the port the snort machine is plugged into into a
monitor port
en
conf t
int f0/#  (#=port #)
switchport monitor 1-24 (or you can give it a vlan # )
^z
wr me


this will cause all traffic from the defince ports, or vlan to be mirrored
to that port..thus letting the snort box see all traffic
if ya get in trouble do a  '?'



----- Original Message -----
From: "Tim Parker" <tparker () kennett net>
To: <snort-users () lists sourceforge net>
Sent: Monday, October 15, 2001 8:11 PM
Subject: [Snort-users] Cisco Switch Question


> I just set up an NT monitoring station at home on my small network and I
> have it plugged into a Linksys 10/100 Switch. At work I have both a
Mandrake
> 8.0 system and an NT box with Snort 1.8, these are both plugged into a
Cisco
> 2912 on my desk. I am not getting any alerts from the two units at work.
> What do I need to do differently? I just want them to monitor the subnet
> they are on now for testing. Eventually (after a learn a bit more!) I am
> going to be setting up a unit to monitor a DMZ and a web site. Thanks for
> any pointers.....
>
>
>
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users