Re: Port Mirroring

If you're working with VMware and need to keep an eye on your network traffic, grab an extra network card (NIC) and hook it up to your virtual machine. Make sure to switch its settings to promiscuous mode. Then, connect this NIC to a mirror port on your switch. This way, your virtual machine can see all the network traffic that's coming and going, just like a traffic cop watching cars at an intersection.

Good luck 🍀

James Evans
Project Manager

(830) 931-7998

Texas Technology

166 Menefee St Ste D133

Hondo Texas 78861

http://txtechnology.net

On Mar 7, 2024, at 5:31 PM, James Ladd via Snort-users <[email protected]> wrote:



If your doing this on a vm in VMware you will want to pass a secondary dedicated Nic thru to that vm and set it for promiscuous mode. Then plug your mirror port from your switch into that Nic.

Thanks,

James

----------

From: Snort-users <[email protected]> on behalf of Paul Giovanni <[email protected]>

Sent: Tuesday, March 5, 2024 1:10:54 PM

To: [email protected] <[email protected]>

Subject: [Snort-users] Port Mirroring

All,

I have a managed switch connected to my fire wall that I can port mirror from. However, I’m unsure where to plug the mirrored port in. Do I plug it right into my ESXI host. This host is hosting the VM that’s running snort.

Thanks,

Paul Giovanni​​​​

IT Project Manager

Edison, NJ P: (732) 985-5000

Gloucester City, NJ P: (856) 212-0050

https://www.facebook.com/RaritanGroup/

https://www.instagram.com/raritangroup/

https://www.linkedin.com/company/raritan-group

http://www.raritangroup.com/

_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

To unsubscribe, send an email to:
[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette

_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

	To unsubscribe, send an email to:
	[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette