RE: IPS and Trunking

Hi Trav,
Put this together a while back to detail how to do this with a number of
vendor switches
http://www.securitywizardry.com/switch.htm
The advent of switched networks resulted in Network IDS having great
difficulty in promiscuously monitoring their networks. This was overcome by
configuring a switch to replicate the data from all ports or VLAN's onto a
single port. This function has a multitude of names including; Port
Mirroring, Monitoring Port, Spanning Port, SPAN port and Link Mode port.
Generally Port Mirroring usually indicates the ability to copy the traffic
from a single port to a mirror port but disallows any type of bidirectional
traffic on the port.
Spanning Port usually indicates the ability to copy traffic from all the
ports to a single port but also typically disallows bidirectional traffic on
the port. In the case of Cisco, SPAN stands for Switch Port ANalyzer. Some
switches do not allow SPAN ports to transmit packets, this is an issue if
you wish to use IDS TCP countermeasures such as resets. It may also be
worth looking at Network Taps which allow you to tap into a network, taking
a parallel feed for the Network IDS

Regards

Andy Cuff
Managing Director / CEO
Computer Network Defence Ltd
www.SecurityWizardry.com
Tel 0870 321 9014
Mob 0701 070 9014
International +44 1225 811777

-----Original Message-----
From: listbounce@xxxxxxxxxxxxxxxxx
[mailto:listbounce@xxxxxxxxxxxxxxxxx] On Behalf Of trav_2@xxxxxxxxxxx
Sent: 08 February 2007 18:04
To: focus-ids@xxxxxxxxxxxxxxxxx
Subject: IPS and Trunking

Cisco has a great feature where I can configure all traffic
on a switch to go to a trunk port, plug in the IPS/IDS to the
trunk port and see all traffic. Can other vendors, such as
Sourcefire, TippingPoint, ISS do this?

Thanks,

--------------------------------------------------------------
----------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world
attacks from CORE IMPACT.
Go to
http://www.coresecurity.com/index.php5?module=Form&action=impa
ct&campaign=intro_sfw
to learn more.
--------------------------------------------------------------
----------






------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it
with real-world attacks from CORE IMPACT.
Go to http://www.coresecurity.com/index.php5?module=Form&action=impact&campaign=intro_sfw
to learn more.
------------------------------------------------------------------------

Relevant Pages

  • RE: about mirroring port
    ... I would recommend that you not try any 'mirroring' or 'port ... This creates numerous problems within a network, ... On some Cisco routers, I believe that you can use a 'tap port', which allows ... onto multiple IDSes. ...
    (Focus-IDS)
  • Re: Snort/ACID only collecting info for itself, not network
    ... A proper network switch keeps all traffic not destined for you ... > your port. ... Which makes me reiterate an original concern: When I click "portscan ...
    (comp.os.linux.misc)
  • possible arpspoofing
    ... about midnight the network behaves really strange. ... i went there and accessed the switch via ethernet ... the port with the mac-adresse, ... disconnectings, reconnnectings. ...
    (comp.security.misc)
  • Re: One workstation cant access email from ISP - CROSSPOST
    ... Now telnet to Port 110 ... Ethernet adapter Wireless Network Connection: ... Switch is nothing more than a patch panel; ...
    (microsoft.public.exchange.admin)
  • Re: Network cable to capture data..
    ... >>all the data transferred over it to a IDS system in a RX only config, ... You can "listen in" stealthily via your network equipment. ... you need to mirror the port of the computer ... or to the mirror-port on your switch. ...
    (comp.os.linux.networking)