Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to deploy a Snort box in my LAN. I have a Linksys SRW248G4 and trying to configure Port mirroring so that Snort can listen everything on the network in promiscuous mode.

So in ADMIN / Port Mirroring, I have 3 things:

  • Source Port (e1,...e48, g1...g4)
  • Type (Rx, Tx, Both)
  • Target (e1...e48, g1...g4)

Last time I played with it, I killed all traffic on the switch, I had to reboot it several times... so now I'm asking question before:

Do I need to configure each Source Port (from 1 to 48) to forward to the single promiscuous port ? 48 rules !? Is that correct ?

Thanks !

share|improve this question
add comment

1 Answer

up vote 1 down vote accepted

According to this cisco page for that switch,

Only one port can be monitored by a monitoring port at a time.

You may be ok if you just set the source port as the port that uplinks to your router, since this will get you everything coming and going from your network.

When you say that you killed the switch last time you played with it, do you know what happened? I'd recommend understanding what you did wrong before playing with it again, otherwise you are likely to get the same results.

share|improve this answer
    
Jed is right, the only port you need to mirror is the one that your using as an uplink. It is unlikely that you'll have malware/violations between two computers on your LAN without it first going through your uplink and without the malware/violation trying to connect to something on the internet. –  TrueDuality Jun 17 '10 at 16:34
    
I forgot exactly what I did, but I'm quite sure I monitored the link coming from the router as you said. I couldn't really investigate what was going on, I had 30 peoples without internet so... I'll try again on another switch in a mini lab lan then. Thanks –  Bastien974 Jun 17 '10 at 16:40
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.