Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to deploy a Snort box in my LAN. I have a Linksys SRW248G4 and trying to configure Port mirroring so that Snort can listen everything on the network in promiscuous mode.

So in ADMIN / Port Mirroring, I have 3 things:

  • Source Port (e1,...e48, g1...g4)
  • Type (Rx, Tx, Both)
  • Target (e1...e48, g1...g4)

Last time I played with it, I killed all traffic on the switch, I had to reboot it several times... so now I'm asking question before:

Do I need to configure each Source Port (from 1 to 48) to forward to the single promiscuous port ? 48 rules !? Is that correct ?

Thanks !

share|improve this question
up vote 1 down vote accepted

According to this cisco page for that switch,

Only one port can be monitored by a monitoring port at a time.

You may be ok if you just set the source port as the port that uplinks to your router, since this will get you everything coming and going from your network.

When you say that you killed the switch last time you played with it, do you know what happened? I'd recommend understanding what you did wrong before playing with it again, otherwise you are likely to get the same results.

share|improve this answer
Jed is right, the only port you need to mirror is the one that your using as an uplink. It is unlikely that you'll have malware/violations between two computers on your LAN without it first going through your uplink and without the malware/violation trying to connect to something on the internet. – TrueDuality Jun 17 '10 at 16:34
I forgot exactly what I did, but I'm quite sure I monitored the link coming from the router as you said. I couldn't really investigate what was going on, I had 30 peoples without internet so... I'll try again on another switch in a mini lab lan then. Thanks – Bastien974 Jun 17 '10 at 16:40

The monitoring port is not accessible over the network. he probably set all 48 ports as the monitoring port which made the switch unavauilable over the network. You would have to use the console port to undo the monitoring.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.