Comments on: ASA 5505 Monitor Ports - For IDS/IPS/Snort etc http://cisconews.co.uk/2007/12/16/asa-5505-monitor-ports-for-idsipssnort-etc/ Sat, 19 May 2012 16:32:14 +0000 http://wordpress.org/?v=2.6 By: Rich http://cisconews.co.uk/2007/12/16/asa-5505-monitor-ports-for-idsipssnort-etc/#comment-1370 Rich Wed, 09 Jul 2008 09:05:53 +0000 http://cisconews.co.uk/2007/12/16/asa-5505-monitor-ports-for-idsipssnort-etc/#comment-1370 Probably the quickest would be to plug a laptop into the destination port with Wireshark installed and start a capture. You should see the raw packets in Wireshark. Its a free application anyway, not to mention very useful! The config I posted is tested as working so it should be fine, there isnt really a lot to go wrong with it. Let us know how you get on. Cheers, Probably the quickest would be to plug a laptop into the destination port with Wireshark installed and start a capture. You should see the raw packets in Wireshark. Its a free application anyway, not to mention very useful!

The config I posted is tested as working so it should be fine, there isnt really a lot to go wrong with it.

Let us know how you get on.

Cheers,

]]> By: David http://cisconews.co.uk/2007/12/16/asa-5505-monitor-ports-for-idsipssnort-etc/#comment-1063 David Wed, 25 Jun 2008 03:31:39 +0000 http://cisconews.co.uk/2007/12/16/asa-5505-monitor-ports-for-idsipssnort-etc/#comment-1063 Can you suggest an easy way to verify the mirroring is happening? I'm trying to debug a Websense install and I want to make sure the ASA configuration is not the issue. Can you suggest an easy way to verify the mirroring is happening? I’m trying to debug a Websense install and I want to make sure the ASA configuration is not the issue.

]]> By: Rich http://cisconews.co.uk/2007/12/16/asa-5505-monitor-ports-for-idsipssnort-etc/#comment-302 Rich Thu, 17 Jan 2008 22:02:17 +0000 http://cisconews.co.uk/2007/12/16/asa-5505-monitor-ports-for-idsipssnort-etc/#comment-302 I was quite suprised to find the feature too :) Was certainly very useful for my MARS/IPS lab! Thanks for stopping by :) I was quite suprised to find the feature too :) Was certainly very useful for my MARS/IPS lab!

Thanks for stopping by :)

]]> By: matt http://cisconews.co.uk/2007/12/16/asa-5505-monitor-ports-for-idsipssnort-etc/#comment-298 matt Thu, 17 Jan 2008 03:51:43 +0000 http://cisconews.co.uk/2007/12/16/asa-5505-monitor-ports-for-idsipssnort-etc/#comment-298 Excellent! I can't believe I didn't know this. ;-) Great tip! Excellent! I can’t believe I didn’t know this. ;-) Great tip!

]]>