Don't see traffic unless have IP

["Jhumri Tilayia" <tilayia () hotmail com>]

Hello,

I am mirroring traffic on a Cisco switch to the port where the Snort box is 
hanging off of. The interface on the Snort box has no IP address. The 
problem is that Snort does not see any traffic if that interface does not 
have an IP assigned to it. As soon as I assign any random IP to it it works 
just fine.

Is it a known issue with Snort or does it sound like something to do with 
the switch (Cisco 6500) we are using ?

Also, is it possible to use a port that sees all the mirrored traffic as a 
source port (i.e. can I connect to the interface hanging off of that port ?)

Thanks.



_________________________________________________________________
Join the world’s largest e-mail service with MSN Hotmail. 
http://www.hotmail.com


_______________________________________________________________
Hundreds of nodes, one monster rendering program.
Now that's a super model! Visit http://clustering.foundries.sf.net/

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users