Snort mailing list archives
Re: Catalyst 3500 + snort
From: twig les <twigles () yahoo com>
Date: Mon, 11 Aug 2003 09:42:56 -0700 (PDT)
RTFM --- Ahmad Masood Shah <jahil () 66-uetclub com> wrote:
thanks for your kind of help. it's working like charm. Can u please let me know an online tut or help for snort. I'm running snort, ACID, MySql quit fine. I need some depth help for rules, include files, and preprocessors. please let me know. I have study snort tut and help file although they contain some sort of good knowledge but I need more. -- Best Regs, Masood Ahmad Shah System Administrator ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ | * * * * * * * * * * * * * * * * * * * * * * * * | Fibre Net (Pvt) Ltd. Lahore, Pakistan | Tel: +92-42-6677024 | Mobile: +92-300-4277367 | http://www.fibre.net.pk | * * * * * * * * * * * * * * * * * * * * * * * * ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ Unix is very simple, but it takes a genius to understand the simplicity. (Dennis Ritchie) ----- Original Message ----- From: "Faiz Ahmad Shuja" <faizshuja () yahoo it> To: "'Ahmad Masood Shah'" <jahil () 66-uetclub com>; <snort-users () lists sourceforge net> Sent: Monday, August 11, 2003 2:56 PM Subject: RE: [Snort-users] Catalyst 3500 + snort | Yes, Cisco Catalyst 3500 Series XL switches support SPAN. You can find | how-to at: |
http://www.cisco.com/en/US/products/hw/switches/ps637/products_configura
| tion_guide_chapter09186a008007e838.html#xtocid22 | | ---- | | Configuring SPAN | You can use Switch Port Analyzer (SPAN) to monitor traffic on a given | port by forwarding incoming and outgoing traffic on the port to another | port in the same VLAN. A SPAN port cannot monitor ports in a different | VLAN, and a SPAN port must be a static-access port. You can define any | number of ports as SPAN ports, and any combination of ports can be | monitored. | | | Enabling SPAN | Beginning in privileged EXEC mode, follow these steps to enable SPAN: | | | Step 1 configure terminal [Enter global configuration mode.] | | Step 2 interface interface [Enter interface configuration mode, and | enter the port that acts as the monitor port.] | | Step 3 port monitor interface [Enable port monitoring on the port.] | | Step 4 end [Return to privileged EXEC mode.] | | Step 5 show running-config [Verify your entries.] | | ---- | | Regards, | Faiz | | | | -----Original Message----- | From: snort-users-admin () lists sourceforge net | [mailto:snort-users-admin () lists sourceforge net] On Behalf Of Ahmad | Masood Shah | Sent: Monday, August 11, 2003 2:21 PM | To: snort-users () lists sourceforge net | Subject: [Snort-users] Catalyst 3500 + snort | | | I'm using snort as NIDS. I have Cisco Catalyst 3500 Series XL. I want to | use one port of this switch as traffic mirroring. I mean to say SPAN | post. now question becomes is Cisco Catalyst 3500 support things which I | required. If yes then please let me know how can I do that. save my time | to search goolge etc for this :) | | Advance thanks for your help. | | | -- | | Best Regs, | Masood Ahmad Shah | System Administrator | | ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ | | * * * * * * * * * * * * * * * * * * * * * * * * | | Fibre Net (Pvt) Ltd. Lahore, Pakistan | | Tel: +92-42-6677024 | | Mobile: +92-300-4277367 | | http://www.fibre.net.pk | | * * * * * * * * * * * * * * * * * * * * * * * * | ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ | Unix is very simple, but it takes a genius to understand the simplicity. | (Dennis Ritchie) | | | | ------------------------------------------------------- | This SF.Net email sponsored by: Free pre-built ASP.NET sites including | Data Reports, E-commerce, Portals, and Forums are available now. | Download today and enter to win an XBOX or Visual Studio .NET. |
http://aspnet.click-url.com/go/psa00100003ave/direct;at.aspnet_072303_01
| /01 | _______________________________________________ | Snort-users mailing list | Snort-users () lists sourceforge net | Go to this URL to change user options or unsubscribe: | https://lists.sourceforge.net/lists/listinfo/snort-users | Snort-users list archive: | http://www.geocrawler.com/redir-sf.php3?list=snort-users |
ATTACHMENT part 2 application/x-pkcs7-signature name=smime.p7s
===== ----------------------------------------------------------- Emo is what happens when the glee club goes punk. ----------------------------------------------------------- __________________________________ Do you Yahoo!? Yahoo! SiteBuilder - Free, easy-to-use web site design software http://sitebuilder.yahoo.com ------------------------------------------------------- This SF.Net email sponsored by: Free pre-built ASP.NET sites including Data Reports, E-commerce, Portals, and Forums are available now. Download today and enter to win an XBOX or Visual Studio .NET. http://aspnet.click-url.com/go/psa00100003ave/direct;at.aspnet_072303_01/01 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Catalyst 3500 + snort Ahmad Masood Shah (Aug 11)
- RE: Catalyst 3500 + snort Faiz Ahmad Shuja (Aug 11)
- Re: Catalyst 3500 + snort Ahmad Masood Shah (Aug 11)
- Re: Catalyst 3500 + snort twig les (Aug 11)
- RE: Catalyst 3500 + snort Faiz Ahmad Shuja (Aug 11)
- Re: Catalyst 3500 + snort Ahmad Masood Shah (Aug 11)
- Re: Catalyst 3500 + snort Erek Adams (Aug 11)
- Re: Catalyst 3500 + snort Ahmad Masood Shah (Aug 11)
- <Possible follow-ups>
- RE: Catalyst 3500 + snort Grime, Richard S (Aug 11)
- RE: Catalyst 3500 + snort Faiz Ahmad Shuja (Aug 11)