Stephen Reese

Like most I do not have the funds to purchase a $1000 port aggregation tap for my IDS to monitor traffic so instead I just used a 2950 Cisco Switch:

!
interface FastEthernet0/1
switchport access vlan 100
duplex full
!
interface FastEthernet0/2
switchport access vlan 100
duplex full
!
interface FastEthernet0/3
!

so the first two ports are where the traffic comes in and back out to the destination device, the third will go to my network sensor. Next let us setup the port spanning.

!
monitor session 1 source interface Fa0/1
monitor session 1 destination interface Fa0/3

Note that you may check other options such as spanning multiple ports or even vlans.


Comments

comments powered by Disqus