Re: Catalyst 3500 + snort

[twig les <twigles () yahoo com>]

RTFM

--- Ahmad Masood Shah <jahil () 66-uetclub com> wrote:
> thanks for your kind of help. it's working like charm. Can u
> please let me
> know an online tut or help for snort. I'm running snort, ACID,
> MySql quit
> fine. I need some depth help for rules, include files, and
> preprocessors.
> please let me know. I have study snort tut and help file
> although they
> contain some sort of good knowledge but I need more.
>
> -- 
>
> Best Regs,
> Masood Ahmad Shah
> System Administrator
>
> ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^
> |   * * * * * * * * * * * * * * * * * * * * * * * *
> |   Fibre Net (Pvt) Ltd. Lahore, Pakistan
> |   Tel: +92-42-6677024
> |   Mobile: +92-300-4277367
> |   http://www.fibre.net.pk
> |   * * * * * * * * * * * * * * * * * * * * * * * *
> ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^
> Unix is very simple, but it takes a genius to understand the
> simplicity.
> (Dennis Ritchie)
>
> ----- Original Message ----- 
> From: "Faiz Ahmad Shuja" <faizshuja () yahoo it>
> To: "'Ahmad Masood Shah'" <jahil () 66-uetclub com>;
> <snort-users () lists sourceforge net>
> Sent: Monday, August 11, 2003 2:56 PM
> Subject: RE: [Snort-users] Catalyst 3500 + snort
>
>
> | Yes, Cisco Catalyst 3500 Series XL switches support SPAN.
> You can find
> | how-to at:
> |
http://www.cisco.com/en/US/products/hw/switches/ps637/products_configura
> | tion_guide_chapter09186a008007e838.html#xtocid22
> |
> | ----
> |
> | Configuring SPAN
> | You can use Switch Port Analyzer (SPAN) to monitor traffic
> on a given
> | port by forwarding incoming and outgoing traffic on the port
> to another
> | port in the same VLAN. A SPAN port cannot monitor ports in a
> different
> | VLAN, and a SPAN port must be a static-access port. You can
> define any
> | number of ports as SPAN ports, and any combination of ports
> can be
> | monitored.
> |
> |
> | Enabling SPAN
> | Beginning in privileged EXEC mode, follow these steps to
> enable SPAN:
> |
> |
> | Step 1  configure terminal  [Enter global configuration
> mode.]
> |
> | Step 2  interface interface [Enter interface configuration
> mode, and
> | enter the port that acts as the monitor port.]
> |
> | Step 3  port monitor interface [Enable port monitoring on
> the port.]
> |
> | Step 4  end [Return to privileged EXEC mode.]
> |
> | Step 5  show running-config [Verify your entries.]
> |
> | ----
> |
> | Regards,
> | Faiz
> |
> |
> |
> | -----Original Message-----
> | From: snort-users-admin () lists sourceforge net
> | [mailto:snort-users-admin () lists sourceforge net] On Behalf
> Of Ahmad
> | Masood Shah
> | Sent: Monday, August 11, 2003 2:21 PM
> | To: snort-users () lists sourceforge net
> | Subject: [Snort-users] Catalyst 3500 + snort
> |
> |
> | I'm using snort as NIDS. I have Cisco Catalyst 3500 Series
> XL. I want to
> | use one port of this switch as traffic mirroring. I mean to
> say SPAN
> | post. now question becomes is Cisco Catalyst 3500 support
> things which I
> | required. If yes then please let me know how can I do that.
> save my time
> | to search goolge etc for this :)
> |
> | Advance thanks for your help.
> |
> |
> | -- 
> |
> | Best Regs,
> | Masood Ahmad Shah
> | System Administrator
> |
> | ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^
> | |   * * * * * * * * * * * * * * * * * * * * * * * *
> | |   Fibre Net (Pvt) Ltd. Lahore, Pakistan
> | |   Tel: +92-42-6677024
> | |   Mobile: +92-300-4277367
> | |   http://www.fibre.net.pk
> | |   * * * * * * * * * * * * * * * * * * * * * * * *
> | ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^
> | Unix is very simple, but it takes a genius to understand the
> simplicity.
> | (Dennis Ritchie)
> |
> |
> |
> | -------------------------------------------------------
> | This SF.Net email sponsored by: Free pre-built ASP.NET sites
> including
> | Data Reports, E-commerce, Portals, and Forums are available
> now.
> | Download today and enter to win an XBOX or Visual Studio
> .NET.
> |
http://aspnet.click-url.com/go/psa00100003ave/direct;at.aspnet_072303_01
> | /01
> | _______________________________________________
> | Snort-users mailing list
> | Snort-users () lists sourceforge net
> | Go to this URL to change user options or unsubscribe:
> | https://lists.sourceforge.net/lists/listinfo/snort-users
> | Snort-users list archive:
> | http://www.geocrawler.com/redir-sf.php3?list=snort-users
> |

> ATTACHMENT part 2 application/x-pkcs7-signature name=smime.p7s



=====
-----------------------------------------------------------
Emo is what happens when the glee club goes punk.       
-----------------------------------------------------------

__________________________________
Do you Yahoo!?
Yahoo! SiteBuilder - Free, easy-to-use web site design software
http://sitebuilder.yahoo.com


-------------------------------------------------------
This SF.Net email sponsored by: Free pre-built ASP.NET sites including
Data Reports, E-commerce, Portals, and Forums are available now.
Download today and enter to win an XBOX or Visual Studio .NET.
http://aspnet.click-url.com/go/psa00100003ave/direct;at.aspnet_072303_01/01
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users