Hi, I've a problem with a Cisco Catalyst 2950 Switch (release 12.1(14) and Snort (but ntop too)).
1) I've set the switch port where the Internet router is as "source", with the "monitor session" command
2) I've set the switch port where the monitoring Pc is as "destination"
I changed some configuration, according newsgroups, but Snort sees only Arp requests and broadcast traffic.
Where is the unicast traffic? Where is the problem?
Thank you in advance.