Re: setting up a mirroring port at switch

["d_greenjr" <d_greenjr () hotmail com>]

It would help to know which type of switch you have.  On some of the larger
cisco switches you need to type the command "set span <src_prt> <dst_prt>".
On some of the smaller cisco switches you have to 1) configure the terminal
[config t], 2)select the destination interface [interface fa0/48], 3) select
the source interface to be monitored [port mirror fa0/12], 4) Ctrl-Z.

NOTE:  All this is done after you have entered the exec priv mode.
DISCLAIMER: The syntax for the smaller cisco switch may be off on step three
so type "port mirr" and press the tab key for auto-completion.


----- Original Message -----
From: "smitha rao" <meetsmithahv () yahoo com>
To: <snort-users () lists sourceforge net>
Sent: Saturday, April 26, 2003 6:36 AM
Subject: [Snort-users] setting up a mirroring port at switch


> hi all,
> I am testing snort in a machine which is connected to
> a star topology LAN.My m/c is an end m/c ,to which all
> the network traffic will not be redirected...I want my
> snort to test all the traffic.I dont want to test it
> on firewall m/c as it'll be similar as my nsort is
> running outside the firewall..resulting in unwanted
> alerts..
> I wanted to setup a mirroring port..How to set it up?
> so that all traffic comes to my m/c..Do anybody have a
> procedure to setup mirroring port at the switch level.
>  plz help me..
>                   thank you
>
> __________________________________
> Do you Yahoo!?
> The New Yahoo! Search - Faster. Easier. Bingo.
> http://search.yahoo.com
>
>
> -------------------------------------------------------
> This sf.net email is sponsored by:ThinkGeek
> Welcome to geek heaven.
> http://thinkgeek.com/sf
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users


-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users