snort + trunk + cat6500 + vacls

[Andrew White]

Read
http://www.cisco.com/en/US/customer/products/hw/switches/ps700/products_
tech_note09186a008015c612.shtml

Basically you hook up your snort interface to the switch, then tell the
switch to span out the relevant vlans to that port, as far as I'm aware,
these packets will be missing the tag header when they come out the span
port, so you will see them as if they were all on your local wire..

Look at snort support groups for more details.

.Andrew

-----Original Message-----
From: owner-freebsd-questions at freebsd.org
[mailto:owner-freebsd-questions at freebsd.org] On Behalf Of John
Sent: 10 October 2003 00:38
To: freebsd-questions at freebsd.org
Subject: snort + trunk + cat6500 + vacls

i'm testing out alternatives for using span ports or inline taps and
came
across a doc on using vlan acls to capture data and send them to a port
for
sniffing. From what i under stand the sniffer port needs to be a trunk
port.
What i don't really understand is how freebsd is going to work with the
trunk.
Do i need a vlan interface for every vlan in the trunk, or do i only
need one
vlan interface to match the native vlan of the trunk?
Also what should i be sniffing? the vlan interface(s) or the real
interface?

btw i'm no switch engineer so go easy on me :)

oh, and one more thing.
debug.bpf_bufsize: 4096 <- shold this be increased or will snort overide
this 
number?
_______________________________________________
freebsd-questions at freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to
"freebsd-questions-unsubscribe at freebsd.org"