Re: Port Mirroring

We have 3 ports on the back of the server. It seems like one of them is for IDRAC (integrated dell remote access controller.. basically remote management). The other two seem to be on one card, serving as a single switch. See image below:

[cid:[email protected]]


Am I able to use vmnic0 or vmnic1 for this purpose? Or would be need to buy a separate NIC to plugin to a PCIe port? If not I’ll probably just end up buying a raspberry pi to have a “snort in a box”


Paul Giovanni
IT Project Manager
Edison, NJ P: (732) 985-5000
 
Gloucester City, NJ P: (856) 212-0050
From: James Ladd <[email protected]>
Sent: Thursday, March 7, 2024 6:30 PM
To: Paul Giovanni <[email protected]>; [email protected]
Subject: Re: Port Mirroring

You don't often get email from [email protected]<mailto:[email protected]>. Learn why this is important<https://aka.ms/LearnAboutSenderIdentification>
If your doing this on a vm in VMware you will want to pass a secondary dedicated Nic thru to that vm and set it for promiscuous mode. Then plug your mirror port from your switch into that Nic.

Thanks,
James
________________________________
From: Snort-users <[email protected]<mailto:[email protected]>> on behalf of Paul Giovanni <[email protected]<mailto:[email protected]>>
Sent: Tuesday, March 5, 2024 1:10:54 PM
To: [email protected]<mailto:[email protected]> <[email protected]<mailto:[email protected]>>
Subject: [Snort-users] Port Mirroring


All,



I have a managed switch connected to my fire wall that I can port mirror from. However, I’m unsure where to plug the mirrored port in. Do I plug it right into my ESXI host. This host is hosting the VM that’s running snort.



Thanks,



Paul Giovanni​​​​

IT Project Manager

Edison, NJ<https://urldefense.proofpoint.com/v2/url?u=https-3A__goo.gl_alXFy5&d=DwMGaQ&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=h7KmwhwQTf-8idLOkUGqw_U9le4wAdZNjMPKN0d78EY&m=WkEgvd3W36iY6YwGinG2GY5JiEa5PIxCpJWJmMpZorLW7Zj6bVev8BYuQ7cJw31y&s=uttQ47WQVfhDm26PbzETSVOFRZjA4klXbaHtYILfaU0&e=> P: <tel:7329855000> (732) 985-5000<tel:7329855000>

Gloucester City, NJ<https://urldefense.proofpoint.com/v2/url?u=https-3A__goo.gl_PgMNnW&d=DwMGaQ&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=h7KmwhwQTf-8idLOkUGqw_U9le4wAdZNjMPKN0d78EY&m=WkEgvd3W36iY6YwGinG2GY5JiEa5PIxCpJWJmMpZorLW7Zj6bVev8BYuQ7cJw31y&s=5SgmOYabTaD_WKo3tVgH8xozAYucCSbqon8dP7MoqZ8&e=> P: (856) 212-0050<tel:8562120050>

[cid:[email protected]]<https://urldefense.proofpoint.com/v2/url?u=https-3A__www.facebook.com_RaritanGroup_&d=DwMGaQ&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=h7KmwhwQTf-8idLOkUGqw_U9le4wAdZNjMPKN0d78EY&m=WkEgvd3W36iY6YwGinG2GY5JiEa5PIxCpJWJmMpZorLW7Zj6bVev8BYuQ7cJw31y&s=8t3iRkTRgqf_BPg6kWH9sdFLeztGCcu0zbKRoyTr7T8&e=>

[cid:[email protected]]<https://urldefense.proofpoint.com/v2/url?u=https-3A__www.instagram.com_raritangroup_&d=DwMGaQ&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=h7KmwhwQTf-8idLOkUGqw_U9le4wAdZNjMPKN0d78EY&m=WkEgvd3W36iY6YwGinG2GY5JiEa5PIxCpJWJmMpZorLW7Zj6bVev8BYuQ7cJw31y&s=OvXvkGMNHE2V2T3oQd3_AyzQY8Mra_OjEqzQVHQNEVw&e=>

[cid:[email protected]]<https://urldefense.proofpoint.com/v2/url?u=https-3A__www.linkedin.com_company_raritan-2Dgroup&d=DwMGaQ&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=h7KmwhwQTf-8idLOkUGqw_U9le4wAdZNjMPKN0d78EY&m=WkEgvd3W36iY6YwGinG2GY5JiEa5PIxCpJWJmMpZorLW7Zj6bVev8BYuQ7cJw31y&s=fYJ59q4xZfwllRt2Tt0jEA_mjxNhXrS0_udvpOv3lBU&e=>

[cid:[email protected]]<https://urldefense.proofpoint.com/v2/url?u=http-3A__www.raritangroup.com_&d=DwMGaQ&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=h7KmwhwQTf-8idLOkUGqw_U9le4wAdZNjMPKN0d78EY&m=WkEgvd3W36iY6YwGinG2GY5JiEa5PIxCpJWJmMpZorLW7Zj6bVev8BYuQ7cJw31y&s=-3OS-lSTFbhAy9N-l1QMNkQxdfZaNjmY4lgAl_0pykU&e=>









________________________________

This email has been scanned for spam and viruses. Click here<https://godaddy.cloud-protect.net/app/report_spam.php?mod_id=11&mod_option=logitem&report=1&type=easyspam&k=k1&payload=53616c7465645f5fde94027f7b022c15b8958e0496878c584985d60cd3bc98058aeb65e55a786ae3a664a552be3c42ef4df74871bf94e0cb061a9a839930864fcb7070a6c7ed3b33a481900f3d1e41ebd0c9175ac6d20762a40b8854585cf10240fafbb609c4229ced5a5f52aa59b5e1b04ad7383edef2c4aa2278148d256c73b446380953d8c2dd91d03584c78cc0bc01417addf0040f4cf82a02a9e9504107> to report this email as spam.

_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

	To unsubscribe, send an email to:
	[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette