Snort mailing list archives
Don't see traffic unless have IP
From: "Jhumri Tilayia" <tilayia () hotmail com>
Date: Thu, 16 May 2002 10:44:29 -0400
Hello,I am mirroring traffic on a Cisco switch to the port where the Snort box is hanging off of. The interface on the Snort box has no IP address. The problem is that Snort does not see any traffic if that interface does not have an IP assigned to it. As soon as I assign any random IP to it it works just fine.
Is it a known issue with Snort or does it sound like something to do with the switch (Cisco 6500) we are using ?
Also, is it possible to use a port that sees all the mirrored traffic as a source port (i.e. can I connect to the interface hanging off of that port ?)
Thanks. _________________________________________________________________Join the worlds largest e-mail service with MSN Hotmail. http://www.hotmail.com
_______________________________________________________________ Hundreds of nodes, one monster rendering program. Now that's a super model! Visit http://clustering.foundries.sf.net/ _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Don't see traffic unless have IP Jhumri Tilayia (May 18)
- Re: Don't see traffic unless have IP Glenn Forbes Fleming Larratt (May 18)
- Re: Don't see traffic unless have IP Ian Macdonald (May 22)
- Re: Don't see traffic unless have IP Glenn Forbes Fleming Larratt (May 18)