Hi,
This could be fun,
One port to capture all ports. If the port is 100Meg Full Duplex going into your
captur device and your capture device can deal with all the requests etc made of it.
How many 100Meg ports could you indeed view at the same time. My guess is not many.
You would tend to lose quite a bit of data in your captures.
I would suggest putting a monitor on the ports connecting the servers, be aware that I
am not going to capture all and start from there.
Whilst you can setup 'span' to look at multiple ports be aware the port you are
monitoring from still operates as one port.
the command
set span enable
set span disable
set span <src_mod/src_ports...> <dest_mod/dest_port>
[rx|tx|both] [inpkts <enable|disable>]
set span <src_vlan> <dest_mod/dest_port>
[rx|tx|both] [inpkts <enable|disable>]
Most 'cat' codes provide help.
eg/ set span ?<return> provided the above.
Just some ramblings from an 'old geezer'
Teunis
Hobart, Tasmania
Australia
On Wednesday, February 28, 2001 at 11:16:25 AM, Langa Kentane wrote:
> How do I setup one of my ports to catch the traffic that goes thru all the
> ports on the switch for packet sniffing. I want to put an intrusion
> detection sensor on a switch.
>
> Thanks in advance
>
> _________________________________________________________
> Langa Kentane | Tel: [011] 290 3218
> Security Administrator | Cell: 082 606 1515
> [CNA MCSE CCSA CCNA] | www.discoveryhealth.co.za
> _________________________________________________________
>
> _________________________________
> FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html
> Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
>
>
--
www.tasmail.com
_________________________________
FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html
Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
