RE: Re: What can Snort listen for (again)? (steven)

[Ryan Hill <rhill () xypoint com>]

Piotr,

Check with your switch vendor for instructions on setting this up - if you
have a lower-end switch that supports traffic mirroring (or you don't want
to place the load on the switch itself) you can also look into making an
ethernet tap that sits on the upstream link from your switch.

Cisco - Configuring Catalyst SPAN Ports
http://www.cisco.com/warp/public/473/41.html

For smaller Cisco switches that don't support the SPAN command set, you can
also use the port monitor command for the same functionality (2924XL's for
example).

Ethernet Taps Search:
http://www.google.com/search?q=ethernet+tap

Regards,

Ryan Hill, MCSE 
IT Ninja
Corporate Information Systems
Telecommunication Systems, Inc. (TCS) - http://www.telecomsys.com
v: 206.792.2276 - f: 206.792.2001
pgp: 0x17CE70AB


> -----Original Message-----
> From: Piotr Synowiec [mailto:mysiar () kr sky pl] 
> Sent: Monday, October 22, 2001 1:09 PM
> To: Joe Pampel; SNORT LIST
> Subject: Re: [Snort-users] Re: What can Snort listen for 
> (again)? (steven)
>
>
> On Mon, 2001-10-22 at 21:42, Joe Pampel wrote:
> > If the hosts in question are plugged into the same hub as the snort 
> > sensor you're good to go. If you are running on a switch 
> you have to 
> > create a mirror port for snort (so it can see the traffic
> but how I can create this mirror port.
> I have got network with few switches in chain?
>
> Rgds
> Piotr
>
>
>
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe: 
> https://lists.sourceforge.net/lists/listinfo/s> nort-users
>
> Snort-users list archive: 
> http://www.geocrawler.com/redir-sf.php3?list=snort-users

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users