Re: Setting up Snort with router span port

[Y M <snort () outlook com>]

Hi Michael,
 
Can you please further elaborate on "not seeing all the traffic"? Do you mean that Snort is partially seeing the 
traffic or not seeing the traffic at all? If you run tcpdump on the machine receiving the traffic from the span port, 
do you get any packets?
 
YM
 
Date: Mon, 3 Feb 2014 10:20:56 -0500
From: mike.a.brown09 () gmail com
To: snort-users () lists sourceforge net
Subject: [Snort-users] Setting up Snort with router span port

Hey guys. I did have snort working with a hub but decided to take that out because it was slowing down my network. I 
have a WRT160 Router and want to have a span port. I know the commands to do this but it seems like Snort is not seeing 
all the traffic. All traffic is going to the IP address associated with my eth0 interface. Any one have any hints?



---
Thank you, 

Michael A. Brown
mike.a.brown09 () gmail com
M.S. Forensic Studies: Computer Forensics

B.S. Information Technology: Network Specialist

"The only thing necessary for the triumph of evil is for good men to do nothing" -Edmund Burke


------------------------------------------------------------------------------
Managing the Performance of Cloud-Based Applications
Take advantage of what the Cloud has to offer - Avoid Common Pitfalls.
Read the Whitepaper.
http://pubads.g.doubleclick.net/gampad/clk?id=121051231&iu=/4140/ostg.clktrk
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!                                        

------------------------------------------------------------------------------
Managing the Performance of Cloud-Based Applications
Take advantage of what the Cloud has to offer - Avoid Common Pitfalls.
Read the Whitepaper.
http://pubads.g.doubleclick.net/gampad/clk?id=121051231&iu=/4140/ostg.clktrk

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!