RE: snort + cisco 4x00 catalysts

["Paulo Filipe Mira" <paulo.mira () soquimica pt>]

Thank you, and all that replied off-list.

The feedback i got regarding this switch was pretty
good. Major caveat pointed to me was the possibility
of having more trafic than a port / sensor could handle.
However, as was also pointed out, this switch can SPAN to
multiple ports at the same time, so it would be just a matter
of setting up another snort sensor on a different SPAN port,
and splitting the trafic to be monitored.

Great feedback, guys, thank you very much!

Paulo Filipe Mira
SA
Soquimica
paulo.mira () soquimica pt
Tel: +351 21 716 51 60
Fax: +351 21 716 51 69


> -----Original Message-----
> From: snort-users-admin () lists sourceforge net
> [mailto:snort-users-admin () lists sourceforge net]On Behalf Of twig les
> Sent: quarta-feira, 8 de Outubro de 2003 17:30
> To: paulo.mira () soquimica pt; snort-users () lists sourceforge net
> Subject: Re: [Snort-users] snort + cisco 4x00 catalysts
>
>
> We're sniffing off of a 4000 (the new 4000, not the old EOL
> ones) and it works fine.  The only annoyance was Cisco changing
> the syntax for port mirroring.  There are now 3 different
> syntaxes that I know of.  Pretty minor gripe, the thing does
> what it should.
>
> --- Paulo Filipe Mira <paulo.mira () soquimica pt> wrote:
> > Does anyone have snort sniffing off a Cisco 4000 or a 4500?
> >
> > We are considering getting one of those beasts, and i would
> > like some feedback (good or bad) on snorting off it's SPAN
> > port(s).
> >
> > Is anyone doing this? What are your thoughts?
> >
> > I have read the product literature, but still, i would
> > like to hear some stories from the trenches.
> >
> > TIA
> >
> > Paulo Filipe Mira
> > SA
> > Soquimica
> > paulo.mira () soquimica pt
> > Tel: +351 21 716 51 60
> > Fax: +351 21 716 51 69
> >
> >
> >
> >
> > -------------------------------------------------------
> > This sf.net email is sponsored by:ThinkGeek
> > Welcome to geek heaven.
> > http://thinkgeek.com/sf
> > _______________________________________________
> > Snort-users mailing list
> > Snort-users () lists sourceforge net
> > Go to this URL to change user options or unsubscribe:
> > https://lists.sourceforge.net/lists/listinfo/snort-users
> > Snort-users list archive:
> > http://www.geocrawler.com/redir-sf.php3?list=snort-users
>
>
> =====
> -----------------------------------------------------------
> Get a taste of Religion ... eat a priest!       
> -----------------------------------------------------------
>
> __________________________________
> Do you Yahoo!?
> The New Yahoo! Shopping - with improved product search
> http://shopping.yahoo.com
>
>
> -------------------------------------------------------
> This SF.net email is sponsored by: SF.net Giveback Program.
> SourceForge.net hosts over 70,000 Open Source Projects.
> See the people who have HELPED US provide better services:
> Click here: http://sourceforge.net/supporters.php
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users



-------------------------------------------------------
This SF.net email is sponsored by: SF.net Giveback Program.
SourceForge.net hosts over 70,000 Open Source Projects.
See the people who have HELPED US provide better services:
Click here: http://sourceforge.net/supporters.php
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users