Hub recommendations

[Matt Van Mater <matt.vanmater () gmail com>]

Hi all,

I have 3 separate SPAN ports on Cisco switches feeding traffic to a
soho Netgear 8 port hub, which I then connect to my IDS as well as
other network analysis boxes.  I'm having a problem where one of my
SPAN ports gets errDisabled because of too many collisions coming back
from the hub.  This isn't a big surprise because the hub is now seeing
an average of 5000 packets per sec.

I was wondering if there are any more enterprise level hubs out there
that you would recommend that have big buffers that can handle this
pps load and would result in less collisions being sent back to the
switch.  For that matter, is this the right way to approach this
problem?  If only I could set up multiple destination ports for a SPAN
session I could aggregate these feeds into another switch, and then
have it forward the traffic to my analysis boxes...

To approach the problem from another angle, I know I can auto
re-enable the SPAN port after a certain period of downtime, or simply
turn off errdisabling on the whole switch.  I'd like a solution that
has no downtime, and I don't want to turn off err disabling on the
entire switch in case another port is causing a legitimate problem.  I
haven't seen any indication that I can turn off errdisabling for a
single port only, but if that is possible and just isn't documented, I
think that would be the best solution.

Any suggestions ?

Matt


-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now. 
http://productguide.itmanagersjournal.com/
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users