Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have configured a Cisco 3500 switch with a port SPAN and have my snort node (fedora 13) plugged into it. I am running snort as a daemon and have configured a rule to log all tcp traffic but I am only seeing traffic with a destination of the snort node. I know that the SPAN port is working and wanted to know if there is a specific option that I needed to start snort with in order for it to pickup all the traffic? Or is there something that I have missed here?

Many thanks.

share|improve this question
Did you perhaps mix up your source and destinations for the SPAN? – SpacemanSpiff Dec 16 '10 at 2:15
Do the snort interfaces need to have a default gateway? – aHunter Dec 16 '10 at 2:35
Also the span should be as follows: set span source_port destination_port [rx | tx | both] – aHunter Dec 16 '10 at 2:37
up vote 1 down vote accepted

Depending on the configurations that shipped with your package, you may have some settings wrong. The base snort.conf file should work, however you should inspect the system config file /etc/sysconfig/snort and make sure these two options are set sanely.

  • BPF

Also you should look at the system log, /var/log/messages by default, to see if the interface is actually entering promiscuous mode. If so, you should see something along these lines

kernel: device eth1 entered promiscuous mode

You can also get good debugging information from the perfmonitor preprocessor. You can enable it in your snort.conf with something like

preprocessor perfmonitor: time 300 file /var/log/snort/snort.stats pktcnt 10000

This will dump a VERY large comma delineated list of performance values from the snort application. The full list of all the values dumped can be found in the manual, either shipped or at snort_manual.pdf You might be interested to look at:

  • Total Packets Received
  • Mbits/Sec (applayer)
  • TCP Sessions Initializing

The values from those, and possibly others, should help determine whether the application itself is even seeing the packets, let alone processing them.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.