Snort mailing list archives
Re: Linux and switch problem???
From: twig les <twigles () yahoo com>
Date: Fri, 19 Jul 2002 10:06:49 -0700 (PDT)
K, I don't know Extreme, but check this out before migrating to the 2912: http://www.cisco.com/warp/public/473/41.html#archXL As for the snort box doing any voodoo, I don't buy it. If there's a problem then it's on the switch and simply putting the switch config back to pre-slowdown config and seeing if the problem goes away should do it. --- Daniel Curry <dcurry () corio com> wrote:
Twig, Thank you for your help. Here are teh answers to your questions? twig les wrote:What kind of switch?Extreme summit 48 We will be installing onto a Cisco 2912.What did you change in the sewitch config for thisproject? Mirror portWhat else is the Linux box doing?Just running snort.Simply putting an interface into promiscious mode can't affect a switch. If you've spanned a Cisco 29xx or 35xx, then you may be in trouble, but make sure you aren't beingscapegoated.That's happened to me before ("Your sniffer isslowingthe network down!!" <huh?>) --- Daniel Curry <dcurry () corio com> wrote:I have configure my eth1 as following. eth1 Link encap:Ethernet HWaddr 00:50:8B:E3:99:7C UP BROADCAST RUNNING PROMISC MULTICAST MTU:1500 Metric:1 RX packets:0 errors:0 dropped:0overruns:0frame:0 TX packets:0 errors:0 dropped:0overruns:0carrier:0 collisions:0 txqueuelen:100 RX bytes:0 (0.0 b) TX bytes:0 (0.0 b) Interrupt:11 Base address:0xc000 However I am getting reports from our networkfolksthat "this is bringing the switch down?" My ifcg-eth1 file looks like this. DEVICE=eth1 BOOTPROTO=static ONBOOT=yes Is there anything wrong with my configuration? Please reply directly. I received snort emailvia"digest" mode. Thank you. -- Daniel Curry PGP AD5A 96DC 7556 A020 B8E7 0E4D 5D5E 9BA5C83E8C92> begin:vcardn:Curry;Daniel tel;fax:650-232-3200 tel;work:650-232-4006 x-mozilla-html:FALSE url:www.corio.com org:Corio Inc adr:;;959 Skyway Road Suite 100;San Carlos;California;94070;USA version:2.1 email;internet:dcurry () corio com title:Sr. Information Security Eng. x-mozilla-cpt:;-5312 fn:Daniel Curry end:vcard=====
-----------------------------------------------------------
All warfare is based on deception.
-----------------------------------------------------------
__________________________________________________ Do You Yahoo!? Yahoo! Autos - Get free new car price quotes http://autos.yahoo.com-- Daniel Curry DIRECT 650-232-4006 FAX 650-232-3200 PGP AD5A 96DC 7556 A020 B8E7 0E4D 5D5E 9BA5 C83E
8C92> begin:vcard
n:Curry;Daniel tel;fax:650-232-3200 tel;work:650-232-4006 x-mozilla-html:FALSE url:www.corio.com org:Corio Inc adr:;;959 Skyway Road Suite 100;San Carlos;California;94070;USA version:2.1 email;internet:dcurry () corio com title:Sr. Information Security Eng. x-mozilla-cpt:;-5312 fn:Daniel Curry end:vcard
===== ----------------------------------------------------------- All warfare is based on deception. ----------------------------------------------------------- __________________________________________________ Do You Yahoo!? Yahoo! Autos - Get free new car price quotes http://autos.yahoo.com ------------------------------------------------------- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Linux and switch problem??? Daniel Curry (Jul 19)
- Re: Linux and switch problem??? twig les (Jul 19)
- Re: Linux and switch problem??? Daniel Curry (Jul 19)
- Re: Linux and switch problem??? twig les (Jul 19)
- Re: Linux and switch problem??? Daniel Curry (Jul 19)
- Re: Linux and switch problem??? Jim Burwell (Jul 19)
- Re: Linux and switch problem??? Daniel Curry (Jul 19)
- Re: Linux and switch problem??? Jim Burwell (Jul 19)
- Re: Linux and switch problem??? twig les (Jul 19)