RE: Cisco Switch Question

[Jim Howard <Jim.Howard () abcv com>]

It sounds like you need to enable SPAN on the ports that your snort machines
are plugged into.  Check your manual for the SPAN function.  Basically you
just tell the switch that a port should receive all the traffic that appears
on all ports.



-----Original Message-----
From: Tim Parker [mailto:tparker () kennett net]
Sent: Monday, October 15, 2001 7:11 PM
To: snort-users () lists sourceforge net
Subject: [Snort-users] Cisco Switch Question


I just set up an NT monitoring station at home on my small network and I
have it plugged into a Linksys 10/100 Switch. At work I have both a Mandrake
8.0 system and an NT box with Snort 1.8, these are both plugged into a Cisco
2912 on my desk. I am not getting any alerts from the two units at work.
What do I need to do differently? I just want them to monitor the subnet
they are on now for testing. Eventually (after a learn a bit more!) I am
going to be setting up a unit to monitor a DMZ and a web site. Thanks for
any pointers.....



_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users