Antwort: [nsp] 6509 & Snort

Hans-Peter Walter HAWA Hans-Peter.Walter at
Wed Feb 25 08:39:12 EST 2004

try using "set span ..."

Have fun,

cat> (enable) show span

Destination     : Port 2/21
Admin Source    : Port 2/4
Oper Source     : None
Direction       : transmit/receive
Incoming Packets: disabled
Learning        : enabled
Filter          : -
Status          : inactive

Total local span sessions:  1

cat> (enable) set span ?
  disable                    Disable port monitoring
  <mod/port>                 Source module and port numbers
  <vlan>                     Source VLAN numbers

cat> (enable) set span 2/4 2/21 ?
  both                       Both receiving and transmitting traffic
  create                     Creating new SPAN session
  filter                     Monitor traffic on selected vlans
  inpkts                     Enable/disable destination port incoming 
  learning                   Enable/disable MAC address learning
  rx                         Receiving traffic
  tx                         Transmitting traffic

"Rieman, Jeff" <j-rieman at>
Gesendet von: cisco-nsp-bounces at
25.02.2004 14:34
        An:     <cisco-nsp at>
        Thema:  [nsp] 6509 & Snort

I am experiencing with snort and a 6509.  The documentation shows where
the snort server should sit between 2 routers to capture all the traffic
that passes between them.  I would like to capture all the traffic that
goes through the 6509.  Is there a way to put a 10/100 port in a mode
where it forwards all the packets to that port also?
cisco-nsp mailing list  cisco-nsp at
archive at

More information about the cisco-nsp mailing list