Re: Port Mirroring

[Glenn Forbes Fleming Larratt <glratt () rice edu>]

I've never been peculiarly clear on 3Com's nomenclature, but we use
switch 1100's and 3300's (which come labelled superstack II or superstack 3,
depending on how new they are) - I think the CLI on the switches
labels the configuration you want "Analyzer", under the "Feature"
menu:

} Menu options: --------------3Com SuperStack II Switch 3300--------------
}  bridge             - Administer bridging/VLANS
}  ethernet           - Administer Ethernet ports
}  feature            - Administer system features
}  ip                 - Administer IP
}  logout             - Logout of the Command Line Interface
}  snmp               - Administer SNMP
}  system             - Administer system-level functions
}
} Type ? for help.
} -----------------------------------Switch 3300 (1)----------------------
} Select menu option: feature
}
} Menu options: --------------3Com SuperStack II Switch 3300--------------
}  analyzer           - Administer Roving Analysis
}  broadcastStormCont - Enable/Disable Broadcast Storm Control
}  resilience         - Administer resilient links
}  trunk              - Administer trunks
}
} Type "q" to return to the previous menu or ? for help.
} -----------------------------------Switch 3300 (1)----------------------
} Select menu option (feature): analyzer
}
} Menu options: --------------3Com SuperStack II Switch 3300--------------
}  add                - Configure the roving analysis port
}  display            - Display the Roving Analysis configuration
}  remove             - Clear the roving analysis port
}  start              - Start monitoring
}  stop               - Stop monitoring
}
} Type "q" to return to the previous menu or ? for help.
} -----------------------------------Switch 3300 (1)----------------------
} Select menu option (feature/analyzer): display
} Roving Analysis Configuration
}
} Monitor Port    Analysis Port   State
} none            none            Disabled



On Thu, 30 Jan 2003, Rich Adamson wrote:

> Date: Thu, 30 Jan 2003 20:35:09 -0600
> From: Rich Adamson <radamson () routers com>
> To: Bruno Benchimol a.k.a. Misty MSt <mistymst () ig com br>,
>      snort-users () lists sourceforge net
> Subject: Re: [Snort-users] Port Mirroring
>
> > I've got a little problem here, i've got a 3com superstack II (10/100 mbits)
> > Switch.
> > i am running snort as a network intrusion detect system, but i couldnt do
> > port morrioring so its just a host IDS.
>
> Check your current installed software version for the specific model of
> switch installed, against the current upgrade version. Some models
> included mirroring in later versions while other models did not. There
> is at least some probability an upgrade may support mirroring.
>
>
>
>
> -------------------------------------------------------
> This SF.NET email is sponsored by:
> SourceForge Enterprise Edition + IBM + LinuxWorld = Something 2 See!
> http://www.vasoftware.com
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users

                                Glenn Forbes Fleming Larratt
                                Rice University Network Management
                                glratt () rice edu



-------------------------------------------------------
This SF.NET email is sponsored by:
SourceForge Enterprise Edition + IBM + LinuxWorld = Something 2 See!
http://www.vasoftware.com
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users