Snort mailing list archives
VLAN Tagged Traffic - Some being missed
From: "Aaron" <snort () microchp org>
Date: Sun, 04 Apr 2004 18:30:37 -0700
Is there a trick to capturing traffic on Cisco capture ports? As Cisco is dropping "mirror" ports and going to capture ports, I now see vlan tagged traffic. The network folks will not let me use mirror ports any more since Cisco is removing that in future releases of their IOS, from what I hear.
The problem is, that in that scenerio, I/Snort only see some of the traffic. Tcpdump also drops many of the packets.
38 packets captured 1414426 packets received by filter 1408138 packets dropped by kernelThat is using libpcap 0.8.3 and tcpdump 3.8.3. Using older versions of libpcap and tcpdump, I see the vlan tags in the output. The latest version does not show them. Neither seems to capture all.
This is on a circuit pushing about 500 megs of traffic. Even on the sensors that only have less than 100 megs of traffic I get the same results and about the same loss.
The snort sensors are dual P4 xeon 2.8Ghz boxes with 1GB ram and ultra3 scsi disks. I am using barnyard 0.2.0-rc2, not that it makes a diff. Info only.
Does it matter that I am getting traffic from multiple vlans? Can Snort handle that?
Regards, Aaron ------------------------------------------------------- This SF.Net email is sponsored by: IBM Linux Tutorials Free Linux tutorial presented by Daniel Robbins, President and CEO of GenToo technologies. Learn everything from fundamentals to system administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- VLAN Tagged Traffic - Some being missed Aaron (Apr 04)
- <Possible follow-ups>
- Re: VLAN Tagged Traffic - Some being missed Mark . Schutzmann (Apr 05)
- Re: VLAN Tagged Traffic - Some being missed Mark . Schutzmann (Apr 05)