RE: RE: IDS taps in a switched network

[blue0ne () igloo org (Jackie Chan)]

Someone wrote:
> Um, the spy port is just ONE port. So what happens when I define a VLAN
> with, say, 24 ports and redirect all that traffic to one spy port? All those
> packets ain't gonna fit through that one little narrow doorway. ;-)

That all depends on the aggregate bandwidth of the switch itself.  Lets
also remember that a 2924 switch has a 3.2 GB backplane.

To echo Rons post, the Shomiti Tap solution is probably the best way to
monitor traffic in a large enterprise.  It is best used in conjunction
with a 2900 switch.

Blue0ne