Re: Configuring Cisco switches...

["Bob Staaf" <rstaaf () cfl rr com>]

Bryan,

    You need to create a network monitoring port on the Cisco Switch.  It
will mirror all the traffic to one port you can connect your snort box to.

http://www.cisco.com/warp/public/473/41.html

Hope this helps!

Bob Staaf
Southern Web Services
Orlando, Fl

----- Original Message -----
From: "Bryan Childs" <bryan.childs () mercator com>
To: <snort-users () lists sourceforge net>
Sent: Friday, September 21, 2001 9:59 AM
Subject: [Snort-users] Configuring Cisco switches...


> [Also posted to the Snort forums]
>
>
> Hi everyone - this question has probably been done to death, but my google
> searching for answers has amounted to nought - so I'm going to have to ask
> it again I'm afraid!
>
> The network here in my building is of course suffering from the recent
Nimda
> virus/worm breakout, and we're trying to track infected boxes with snort.
>
> The entire network here is running on switched ethernet, which is giving
us
> a bit of a headache. Most of the switches are dumb 3Com supplied ones, but
> we've been sensible enough (we think) to plug out snort box into the Cisco
> one which sits at the top of the network.
>
> The trouble is that we *still* don't seem to be able to monitor attacks
> which don't directly go for the snort box itself.
>
> The card is set up in promiscuous mode as it should be - but we think we
> need to do something to the switch to make sure it sees ALL our internal
> network traffic.
>
> Does anyone know what we might have missed? Or have any suggestions at
all?
> Cheers amigos......
>
> Bryan
>
>
>
>
> ********
>
> Mercator - find out more at http://www.mercator.com
>
> The information in this email is confidential and is intended solely for
the addressee(s). Access to this email by anyone else is unauthorised.  If
you are not an intended recipient, you must not read, use or disseminate the
information contained in the email.
> Any views expressed in this message are those of the individual sender,
except where the sender specifically states them to be the views of Mercator
Software Ltd.
> Email to and from Mercator may be monitored.
>
> ********


_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users