How to analyze every switch ports traffic of a Cisco Catalyst 3650G switch?

[MauroTridici]

Dear Users,

I'm a newbie and I'm trying to analyze the traffic on all the ports of a Cisco switch using Snort.

I know that I can use the port mirroring feature to copy the traffic running on source port to a destination port monitored by Snort. But, if I need to analyze all the switch ports, how can I do the work?

Can I consider the switch uplink port as source port? Or I should do it in a different way?

Thank you in advance,

Mauro

[marce1000]

 - You might use a 'span copy' of the uplink port ,check this document for more info's :

                 https://www.cisco.com/c/en/us/support/docs/switches/catalyst-6500-series-switches/10570-41.html

 M.

[marce1000]

 - FYI(2) : https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3650/software/release/16-6/configuration_guide/nmgmt/b_166_nmgmt_3650_cg/b_166_nmgmt_3650_cg_chapter_011.html

 M.

[balaji.bandi]

Mirror the traffic of all the ports and send to SNORT, like spanning the session.

https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3650/software/release/3se/network_management/configuration_guide/b_nm_3se_3650_cg/b_nm_3se_3650_cg_chapter_0111.html

[MauroTridici]

Sorry for my late answer.

Thank you very much to all of you.

I really appreciated.

Mauro

[balaji.bandi]

No worries, Hope our information is very helpfull for you, if this was resolve mark as resolution, so other community member can use as reference - if they have same query.