Comments on: Port Mirroring on a Cisco 3550 Switch http://danielmiessler.com/blog/port-mirroring-on-a-cisco-3550-switch grep understanding Fri, 25 May 2012 02:15:50 +0000 hourly 1 http://wordpress.org/?v=3.3.2 By: Daniel Miessler http://danielmiessler.com/blog/port-mirroring-on-a-cisco-3550-switch/comment-page-1#comment-104741 Daniel Miessler Tue, 18 Dec 2007 14:29:28 +0000 http://dmiessler.com/blogarchive/port-mirroring-on-a-cisco-3550-switch#comment-104741 <p>I agree, guys. The place I implemented this had very little traffic on each port, and even then I realize it's not ideal.</p> <p>The problem is that I need to monitor this <em>network</em>, not just a particular port. At the same client I have a number of taps in place (permanent fixtures that I had them buy) to facilitate ongoing traffic monitoring. I do recognize that this method is superior; it's just that it doesn't let you monitor everything on a low-traffic switch like a span does.</p> <p>The problem with the span, of course, is that at any time one or more of the ports being monitored could become NOT low-traffic, at which point the solution falls apart.</p> <p>At any rate, the post was for remembering syntax for the monitor command more than anything. Good discussion, though.</p> I agree, guys. The place I implemented this had very little traffic on each port, and even then I realize it’s not ideal.

The problem is that I need to monitor this network, not just a particular port. At the same client I have a number of taps in place (permanent fixtures that I had them buy) to facilitate ongoing traffic monitoring. I do recognize that this method is superior; it’s just that it doesn’t let you monitor everything on a low-traffic switch like a span does.

The problem with the span, of course, is that at any time one or more of the ports being monitored could become NOT low-traffic, at which point the solution falls apart.

At any rate, the post was for remembering syntax for the monitor command more than anything. Good discussion, though.

]]> By: Daniel Miessler http://danielmiessler.com/blog/port-mirroring-on-a-cisco-3550-switch/comment-page-1#comment-250443 Daniel Miessler Tue, 18 Dec 2007 14:29:00 +0000 http://dmiessler.com/blogarchive/port-mirroring-on-a-cisco-3550-switch#comment-250443 <p>I agree, guys. The place I implemented this had very little traffic on each port, and even then I realize it's not ideal.</p> <p>The problem is that I need to monitor this <em>network</em>, not just a particular port. At the same client I have a number of taps in place (permanent fixtures that I had them buy) to facilitate ongoing traffic monitoring. I do recognize that this method is superior; it's just that it doesn't let you monitor everything on a low-traffic switch like a span does.</p> <p>The problem with the span, of course, is that at any time one or more of the ports being monitored could become NOT low-traffic, at which point the solution falls apart.</p> <p>At any rate, the post was for remembering syntax for the monitor command more than anything. Good discussion, though.</p> I agree, guys. The place I implemented this had very little traffic on each port, and even then I realize it’s not ideal.

The problem is that I need to monitor this network, not just a particular port. At the same client I have a number of taps in place (permanent fixtures that I had them buy) to facilitate ongoing traffic monitoring. I do recognize that this method is superior; it’s just that it doesn’t let you monitor everything on a low-traffic switch like a span does.

The problem with the span, of course, is that at any time one or more of the ports being monitored could become NOT low-traffic, at which point the solution falls apart.

At any rate, the post was for remembering syntax for the monitor command more than anything. Good discussion, though.

]]> By: Maxo http://danielmiessler.com/blog/port-mirroring-on-a-cisco-3550-switch/comment-page-1#comment-104732 Maxo Tue, 18 Dec 2007 13:37:49 +0000 http://dmiessler.com/blogarchive/port-mirroring-on-a-cisco-3550-switch#comment-104732 <p>I took the CCNA 1-4 (class, not the actual test.) As much as I love networking, that class let me know that I should not pursue a career in it.</p> I took the CCNA 1-4 (class, not the actual test.) As much as I love networking, that class let me know that I should not pursue a career in it.

]]> By: Maxo http://danielmiessler.com/blog/port-mirroring-on-a-cisco-3550-switch/comment-page-1#comment-250442 Maxo Tue, 18 Dec 2007 13:37:00 +0000 http://dmiessler.com/blogarchive/port-mirroring-on-a-cisco-3550-switch#comment-250442 <p>I took the CCNA 1-4 (class, not the actual test.) As much as I love networking, that class let me know that I should not pursue a career in it.</p> I took the CCNA 1-4 (class, not the actual test.) As much as I love networking, that class let me know that I should not pursue a career in it.

]]> By: Saul Lethbridge http://danielmiessler.com/blog/port-mirroring-on-a-cisco-3550-switch/comment-page-1#comment-104673 Saul Lethbridge Tue, 18 Dec 2007 08:48:51 +0000 http://dmiessler.com/blogarchive/port-mirroring-on-a-cisco-3550-switch#comment-104673 <p>I know this is just a reference, but I personally would be very concerned with sending more than a few Fa ports out a single Gi port, considering aggregate traffic. 4 fully saturated Fa ports = 800 Mb.</p> <p>The tao article above is also something to consider, very good info.</p> I know this is just a reference, but I personally would be very concerned with sending more than a few Fa ports out a single Gi port, considering aggregate traffic. 4 fully saturated Fa ports = 800 Mb.

The tao article above is also something to consider, very good info.

]]> By: Saul Lethbridge http://danielmiessler.com/blog/port-mirroring-on-a-cisco-3550-switch/comment-page-1#comment-250441 Saul Lethbridge Tue, 18 Dec 2007 08:48:00 +0000 http://dmiessler.com/blogarchive/port-mirroring-on-a-cisco-3550-switch#comment-250441 <p>I know this is just a reference, but I personally would be very concerned with sending more than a few Fa ports out a single Gi port, considering aggregate traffic. 4 fully saturated Fa ports = 800 Mb.</p> <p>The tao article above is also something to consider, very good info.</p> I know this is just a reference, but I personally would be very concerned with sending more than a few Fa ports out a single Gi port, considering aggregate traffic. 4 fully saturated Fa ports = 800 Mb.

The tao article above is also something to consider, very good info.

]]> By: ghost16825 http://danielmiessler.com/blog/port-mirroring-on-a-cisco-3550-switch/comment-page-1#comment-104666 ghost16825 Tue, 18 Dec 2007 08:16:10 +0000 http://dmiessler.com/blogarchive/port-mirroring-on-a-cisco-3550-switch#comment-104666 <p>Also fyi:</p> <p>http://taosecurity.blogspot.com/2007/12/expert-commentary-on-span-and-rspan.html</p> Also fyi:

http://taosecurity.blogspot.com/2007/12/expert-commentary-on-span-and-rspan.html

]]> By: ghost16825 http://danielmiessler.com/blog/port-mirroring-on-a-cisco-3550-switch/comment-page-1#comment-250440 ghost16825 Tue, 18 Dec 2007 08:16:00 +0000 http://dmiessler.com/blogarchive/port-mirroring-on-a-cisco-3550-switch#comment-250440 <p>Also fyi:</p> <p>http://taosecurity.blogspot.com/2007/12/expert-commentary-on-span-and-rspan.html</p> Also fyi:

http://taosecurity.blogspot.com/2007/12/expert-commentary-on-span-and-rspan.html

]]> By: Saul Lethbridge http://danielmiessler.com/blog/port-mirroring-on-a-cisco-3550-switch/comment-page-1#comment-104565 Saul Lethbridge Mon, 17 Dec 2007 22:41:26 +0000 http://dmiessler.com/blogarchive/port-mirroring-on-a-cisco-3550-switch#comment-104565 <p>4 Fa ports going out 1 Fa port...any dropped packets!!</p> 4 Fa ports going out 1 Fa port…any dropped packets!!

]]> By: Saul Lethbridge http://danielmiessler.com/blog/port-mirroring-on-a-cisco-3550-switch/comment-page-1#comment-250439 Saul Lethbridge Mon, 17 Dec 2007 22:41:00 +0000 http://dmiessler.com/blogarchive/port-mirroring-on-a-cisco-3550-switch#comment-250439 <p>4 Fa ports going out 1 Fa port...any dropped packets!!</p> 4 Fa ports going out 1 Fa port…any dropped packets!!

]]>