topic Re: SNORT and mirroring port? in Network Security https://community.cisco.com/t5/network-security/snort-and-mirroring-port/m-p/475432#M1057034 <HTML><HEAD></HEAD><BODY><P>Yes. You need to figure out what ports contain the traffic you want to view, and also how much data that might be. I knew that a fast ethernet port connecting to a PIX would contain all the data entering and exiting our network, so that is the port I mirrored for snort to monitor. I was mostly interested in monitoring the traffic entering and exiting our network. </P><P></P><P>I am not sure how well snort deals with vlan tags - you might need to ensure that snort is only getting non tagged packets. </P></BODY></HTML> Fri, 09 Sep 2005 15:30:04 GMT mostiguy 2005-09-09T15:30:04Z SNORT and mirroring port? https://community.cisco.com/t5/network-security/snort-and-mirroring-port/m-p/475431#M1057015 <P>I have a 4507R switch with multiple VLANS or subnets. I've installed SNORT on a test machine I have but it doesn't pick up anything outside of it's subnet. According to the documentation I read I won't be able to see all the traffic on the switch and need to mirror a port. Anyone with experience using SNORT with a switched network?</P> Fri, 21 Feb 2020 08:22:54 GMT https://community.cisco.com/t5/network-security/snort-and-mirroring-port/m-p/475431#M1057015 kendalle01 2020-02-21T08:22:54Z Re: SNORT and mirroring port? https://community.cisco.com/t5/network-security/snort-and-mirroring-port/m-p/475432#M1057034 <HTML><HEAD></HEAD><BODY><P>Yes. You need to figure out what ports contain the traffic you want to view, and also how much data that might be. I knew that a fast ethernet port connecting to a PIX would contain all the data entering and exiting our network, so that is the port I mirrored for snort to monitor. I was mostly interested in monitoring the traffic entering and exiting our network. </P><P></P><P>I am not sure how well snort deals with vlan tags - you might need to ensure that snort is only getting non tagged packets. </P></BODY></HTML> Fri, 09 Sep 2005 15:30:04 GMT https://community.cisco.com/t5/network-security/snort-and-mirroring-port/m-p/475432#M1057034 mostiguy 2005-09-09T15:30:04Z