Antwort: [nsp] 6509 & Snort

[Hans-Peter Walter HAWA]

Hi,
try using "set span ..."

Have fun,
HP


cat> (enable) show span

Destination     : Port 2/21
Admin Source    : Port 2/4
Oper Source     : None
Direction       : transmit/receive
Incoming Packets: disabled
Learning        : enabled
Filter          : -
Status          : inactive

------------------------------------------------------------------------
Total local span sessions:  1



cat> (enable) set span ?
  disable                    Disable port monitoring
  <mod/port>                 Source module and port numbers
  <vlan>                     Source VLAN numbers

cat> (enable) set span 2/4 2/21 ?
  both                       Both receiving and transmitting traffic
  create                     Creating new SPAN session
  filter                     Monitor traffic on selected vlans
  inpkts                     Enable/disable destination port incoming 
packets
  learning                   Enable/disable MAC address learning
  rx                         Receiving traffic
  tx                         Transmitting traffic
  <cr> 







"Rieman, Jeff" <j-rieman at onu.edu>
Gesendet von: cisco-nsp-bounces at puck.nether.net
25.02.2004 14:34
 
        An:     <cisco-nsp at puck.nether.net>
        Kopie: 
        Thema:  [nsp] 6509 & Snort


I am experiencing with snort and a 6509.  The documentation shows where
the snort server should sit between 2 routers to capture all the traffic
that passes between them.  I would like to capture all the traffic that
goes through the 6509.  Is there a way to put a 10/100 port in a mode
where it forwards all the packets to that port also?
_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/