RE: Catalyst 3500 + snort

["Faiz Ahmad Shuja" <faizshuja () yahoo it>]

www.snort.org
www.google.com

It would be good if you post specific questions. What kind of help you
needed for rules and stuff?. What you want to do?.

Regards,
Faiz

-----Original Message-----
From: snort-users-admin () lists sourceforge net
[mailto:snort-users-admin () lists sourceforge net] On Behalf Of Ahmad
Masood Shah
Sent: Monday, August 11, 2003 3:47 PM
To: Faiz Ahmad Shuja; snort-users () lists sourceforge net
Subject: Re: [Snort-users] Catalyst 3500 + snort


thanks for your kind of help. it's working like charm. Can u please let
me know an online tut or help for snort. I'm running snort, ACID, MySql
quit fine. I need some depth help for rules, include files, and
preprocessors. please let me know. I have study snort tut and help file
although they contain some sort of good knowledge but I need more.

-- 

Best Regs,
Masood Ahmad Shah
System Administrator

^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^
|   * * * * * * * * * * * * * * * * * * * * * * * *
|   Fibre Net (Pvt) Ltd. Lahore, Pakistan
|   Tel: +92-42-6677024
|   Mobile: +92-300-4277367
|   http://www.fibre.net.pk
|   * * * * * * * * * * * * * * * * * * * * * * * *
^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^
Unix is very simple, but it takes a genius to understand the simplicity.
(Dennis Ritchie)

----- Original Message ----- 
From: "Faiz Ahmad Shuja" <faizshuja () yahoo it>
To: "'Ahmad Masood Shah'" <jahil () 66-uetclub com>;
<snort-users () lists sourceforge net>
Sent: Monday, August 11, 2003 2:56 PM
Subject: RE: [Snort-users] Catalyst 3500 + snort


| Yes, Cisco Catalyst 3500 Series XL switches support SPAN. You can find

| how-to at: 
| http://www.cisco.com/en/US/products/hw/switches/ps637/products_configu
| ra
| tion_guide_chapter09186a008007e838.html#xtocid22
|
| ----
|
| Configuring SPAN
| You can use Switch Port Analyzer (SPAN) to monitor traffic on a given 
| port by forwarding incoming and outgoing traffic on the port to 
| another port in the same VLAN. A SPAN port cannot monitor ports in a 
| different VLAN, and a SPAN port must be a static-access port. You can 
| define any number of ports as SPAN ports, and any combination of ports

| can be monitored.
|
|
| Enabling SPAN
| Beginning in privileged EXEC mode, follow these steps to enable SPAN:
|
|
| Step 1  configure terminal  [Enter global configuration mode.]
|
| Step 2  interface interface [Enter interface configuration mode, and 
| enter the port that acts as the monitor port.]
|
| Step 3  port monitor interface [Enable port monitoring on the port.]
|
| Step 4  end [Return to privileged EXEC mode.]
|
| Step 5  show running-config [Verify your entries.]
|
| ----
|
| Regards,
| Faiz
|
|
|
| -----Original Message-----
| From: snort-users-admin () lists sourceforge net
| [mailto:snort-users-admin () lists sourceforge net] On Behalf Of Ahmad 
| Masood Shah
| Sent: Monday, August 11, 2003 2:21 PM
| To: snort-users () lists sourceforge net
| Subject: [Snort-users] Catalyst 3500 + snort
|
|
| I'm using snort as NIDS. I have Cisco Catalyst 3500 Series XL. I want 
| to use one port of this switch as traffic mirroring. I mean to say 
| SPAN post. now question becomes is Cisco Catalyst 3500 support things 
| which I required. If yes then please let me know how can I do that. 
| save my time to search goolge etc for this :)
|
| Advance thanks for your help.
|
|
| --
|
| Best Regs,
| Masood Ahmad Shah
| System Administrator
|
| ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^
| |   * * * * * * * * * * * * * * * * * * * * * * * *
| |   Fibre Net (Pvt) Ltd. Lahore, Pakistan
| |   Tel: +92-42-6677024
| |   Mobile: +92-300-4277367
| |   http://www.fibre.net.pk
| |   * * * * * * * * * * * * * * * * * * * * * * * *
| ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^
| Unix is very simple, but it takes a genius to understand the 
| simplicity. (Dennis Ritchie)
|
|
|
| -------------------------------------------------------
| This SF.Net email sponsored by: Free pre-built ASP.NET sites including

| Data Reports, E-commerce, Portals, and Forums are available now. 
| Download today and enter to win an XBOX or Visual Studio .NET. 
| http://aspnet.click-url.com/go/psa00100003ave/direct;at.aspnet_072303_
| 01
| /01
| _______________________________________________
| Snort-users mailing list
| Snort-users () lists sourceforge net
| Go to this URL to change user options or unsubscribe:
| https://lists.sourceforge.net/lists/listinfo/snort-users
| Snort-users list archive:
| http://www.geocrawler.com/redir-sf.php3?list=snort-users
|

Attachment: smime.p7s
Description: