Want to win a PS4? Go Premium and enter to win our High-Tech Treats giveaway. Enter to Win

x
?
Solved

IDS configuration

Posted on 2004-08-21
8
Medium Priority
?
482 Views
Last Modified: 2006-11-17
Dear All

I need some help in configuring my IDS 4215 ver 4.0, i have PIX in my network and cisco switch, i want to be able capture all the traffic and worms in my network, can some one help me by giving me the steps and commands to configure it.


Many thanks
0
Comment
Question by:ibmas4002
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
  • 4
8 Comments
 
LVL 1

Expert Comment

by:crazynoodle
ID: 11865308
What kind of switch and what is it running IOS or Catalyst OS?  It is either going to be a span command in Cat OS or Monitor command in IOS.

In any case the gist of it is that you want to connect the promiscuous port of the IDS to a port on the switch.  You then need to specify the source port of the network you wish to monitor.  For example say you have the inside interface of the Pix in Vlan 5 - this would be your source and the destination would be the port you connected the IDS to...  Here is a cut and paste from something I found that will probably does a better job explaining the differences.

Directions
In CatOS, use the following syntax to establish a SPAN session:

set span (source port|source vlan) (destination port) (rx|tx|both)

For example:

set span 3/1 3/2 both
will mirror all traffic from 3/1 to 3/2.

Older workgroup switches follow this syntax:
interface fastethernet 1/5
port monitor 1/2 both
to mirror traffic from 1/2 to 1/5.

Newer IOS on workgroup switches use the monitor session command:
interface fastethernet 1/5
monitor session 1 source interface 1/2 both
or
monitor session 1 source vlan 100 both

Hope this helps a bit..

Regards,

~CN~


0
 
LVL 2

Author Comment

by:ibmas4002
ID: 11865489
Thanks
but it can not find this command in my cisco switch 2950


???

Thanks
0
 
LVL 1

Expert Comment

by:crazynoodle
ID: 11865655
Have tried going into the 'interface' configuration of the port connected to your IDS and looking for the 'port monitor' command?
0
Threat Trends for MSPs to Watch

See the findings.
Despite its humble beginnings, phishing has come a long way since those first crudely constructed emails. Today, phishing sites can appear and disappear in the length of a coffee break, and it takes more than a little know-how to keep your clients secure.

 
LVL 2

Author Comment

by:ibmas4002
ID: 11870150
Yes , but I dont know hy i can not see this command.
0
 
LVL 2

Author Comment

by:ibmas4002
ID: 11873219
Dear  crazynoodle

if i will not configure this command, do i will be able to see the attacks

Thanks
0
 
LVL 1

Expert Comment

by:crazynoodle
ID: 11876317
You need to have the traffic from the vlan or port that you wish to be monitored configured to be sent to the port that connects to the IDS..   I guess you could always plug a hub in between the Switch and the firewall and give that a shot..   But then you can only watch that one segment..   Do a 'show version'  and a show config  on your switch and post here.. that will help alot.

Good luck

Regards,
~CN~
0
 
LVL 2

Author Comment

by:ibmas4002
ID: 11883802
Hello  crazynoodle

I got it Im sorry i was trying the monitor command from other directory ..

now i have the sesning connected to port 15 and i want to monitor all other ports 1-14 16-18

can you tell me the command for this?

Thank you


0
 
LVL 1

Accepted Solution

by:
crazynoodle earned 1000 total points
ID: 11888937
Hello..

Do you have vlans set up on this switch.. and if you do are ports 1-14 in a Vlan?   It would make sense to configure the source as a vlan that encompasses a group of ports..  

Try this link to the configuration commands
http://www.cisco.com/univercd/cc/td/doc/product/lan/cat2950/12119ea1/2950scg/swspan.htm#1036816

again if you post the configuration ( and mark out any real ip addresses) we can nail this down..  this may work

Switch(config)# monitor session 1 source interface FastEthernet 0/1 - 14, FastEthernet 0/16 - 18

Switch(config)# monitor session 1 destination interface FastEthernet 0/15

You need to read up about oversubscribing a destination port and regarding the direction to monitor. By not specifying a direction tx or rx - the default is both.

Good luck
~CN~

0

Featured Post

Ready for your healthcare security check-up?

In the past few years, healthcare organizations have become a prime target for advanced attacks. Does your organization have what it needs to defend itself? Schedule your healthcare security check-up today and download our free Healthcare Security Resource Kit today!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

If you are like regular user of computer nowadays, a good bet that your home computer is on right now, all exposed to world of Internet to be exploited by somebody you do not know and you never will. Internet security issues has been getting worse d…
This article offers some helpful and general tips for safe browsing and online shopping. It offers simple and manageable procedures that help to ensure the safety of one's personal information and the security of any devices.
Have you created a query with information for a calendar? ... and then, abra-cadabra, the calendar is done?! I am going to show you how to make that happen. Visualize your data!  ... really see it To use the code to create a calendar from a q…
In response to a need for security and privacy, and to continue fostering an environment members can turn to for support, solutions, and education, Experts Exchange has created anonymous question capabilities. This new feature is available to our Pr…
Suggested Courses

596 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question