0

I'm trying to deploy a Snort box in my LAN. I have a Linksys SRW248G4 and trying to configure Port mirroring so that Snort can listen everything on the network in promiscuous mode.

So in ADMIN / Port Mirroring, I have 3 things:

  • Source Port (e1,...e48, g1...g4)
  • Type (Rx, Tx, Both)
  • Target (e1...e48, g1...g4)

Last time I played with it, I killed all traffic on the switch, I had to reboot it several times... so now I'm asking question before:

Do I need to configure each Source Port (from 1 to 48) to forward to the single promiscuous port ? 48 rules !? Is that correct ?

Thanks !

Improve this question

2 Answers 2

Reset to default
1

According to this cisco page for that switch,

Only one port can be monitored by a monitoring port at a time.

You may be ok if you just set the source port as the port that uplinks to your router, since this will get you everything coming and going from your network.

When you say that you killed the switch last time you played with it, do you know what happened? I'd recommend understanding what you did wrong before playing with it again, otherwise you are likely to get the same results.

Improve this answer
2
  • 1
    Jed is right, the only port you need to mirror is the one that your using as an uplink. It is unlikely that you'll have malware/violations between two computers on your LAN without it first going through your uplink and without the malware/violation trying to connect to something on the internet.
    – TrueDuality
    Jun 17, 2010 at 16:34
  • I forgot exactly what I did, but I'm quite sure I monitored the link coming from the router as you said. I couldn't really investigate what was going on, I had 30 peoples without internet so... I'll try again on another switch in a mini lab lan then. Thanks
    – Bastien974
    Jun 17, 2010 at 16:40
0

The monitoring port is not accessible over the network. he probably set all 48 ports as the monitoring port which made the switch unavauilable over the network. You would have to use the console port to undo the monitoring.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .