RE: RE: IDS taps in a switched network

[dnewman () networktest com (David Newman)]

> > --Some switches have a "spy port" that allows traffic to be
> redirected. This
> > is really no better than a monitor hanging off a single port,
> since only one
> > port at a time can be monitored.
>
> not true, on ciscos you can have a span port which is the "spy" port, but
> redirect entire VLANS to that port, not just traffic from one other port.

Um, the spy port is just ONE port. So what happens when I define a VLAN
with, say, 24 ports and redirect all that traffic to one spy port? All those
packets ain't gonna fit through that one little narrow doorway. ;-)

24:1 overloading is a somewhat extreme example, but the potential to miss
packets exists anytime there is more than one port being redirected. Even in
a 2:1 situation I may see only 50 percent of the traffic I'm supposedly
monitoring.

Monitoring means seeing the traffic -- all of it.

dn