0

I'm trying to deploy a Snort box in my LAN. I have a Linksys SRW248G4 and trying to configure Port mirroring so that Snort can listen everything on the network in promiscuous mode.

So in ADMIN / Port Mirroring, I have 3 things:

  • Source Port (e1,...e48, g1...g4)
  • Type (Rx, Tx, Both)
  • Target (e1...e48, g1...g4)

Last time I played with it, I killed all traffic on the switch, I had to reboot it several times... so now I'm asking question before:

Do I need to configure each Source Port (from 1 to 48) to forward to the single promiscuous port ? 48 rules !? Is that correct ?

Thanks !

Bastien974
  • 1,896
  • 12
  • 44
  • 62

2 Answers2

1

According to this cisco page for that switch,

Only one port can be monitored by a monitoring port at a time.

You may be ok if you just set the source port as the port that uplinks to your router, since this will get you everything coming and going from your network.

When you say that you killed the switch last time you played with it, do you know what happened? I'd recommend understanding what you did wrong before playing with it again, otherwise you are likely to get the same results.

Jed Daniels
  • 7,282
  • 2
  • 34
  • 42
  • 1
    Jed is right, the only port you need to mirror is the one that your using as an uplink. It is unlikely that you'll have malware/violations between two computers on your LAN without it first going through your uplink and without the malware/violation trying to connect to something on the internet. – TrueDuality Jun 17 '10 at 16:34
  • I forgot exactly what I did, but I'm quite sure I monitored the link coming from the router as you said. I couldn't really investigate what was going on, I had 30 peoples without internet so... I'll try again on another switch in a mini lab lan then. Thanks – Bastien974 Jun 17 '10 at 16:40
0

The monitoring port is not accessible over the network. he probably set all 48 ports as the monitoring port which made the switch unavauilable over the network. You would have to use the console port to undo the monitoring.

Robert Repko
  • 1