RE: Port mirroring across multiple switches

From: Tim (sftim_at_timmah.tcmkt.net)
Date: 12/05/03

  • Next message: Meritt James: "Re: Identifying a computer"
    To: "'Hasnain Atique'" <hatique@hasnains.com>, <security-basics@securityfocus.com>
    Date: Fri, 5 Dec 2003 09:19:32 -0600
    
    

     I wouldn't do that. You'll run into layer 2 loop issues I'm thinking.
    You'll see some especially nasty stuff if you have spanning tree on.

    -Tim

    -----Original Message-----
    From: Hasnain Atique [mailto:hatique@hasnains.com]
    Sent: Thursday, December 04, 2003 4:23 AM
    To: security-basics@securityfocus.com
    Subject: Port mirroring across multiple switches

    What's the best approach to port mirror traffic from multiple switches?
    Should I enable mirroring on one port of each switch, and then connect
    those ports to a hub and put my sniffer on the same hub?

    My ultimate objective is to collect ARP query information from all
    switches.

    Thanks.

    -- H

    ---------------------------------------------------------------------------
    ----------------------------------------------------------------------------

    ---------------------------------------------------------------------------
    ----------------------------------------------------------------------------


  • Next message: Meritt James: "Re: Identifying a computer"

    Relevant Pages

    • Re: Port mirroring across multiple switches
      ... RSPAN will do what you need if your switches support it. ... Port mirroring across multiple switches ... > What's the best approach to port mirror traffic from multiple switches? ... > those ports to a hub and put my sniffer on the same hub? ...
      (Security-Basics)
    • Re: chaining hubs and switches
      ... The hub limitation is about collision and the fact that everybody receive every packet, so trunk between hubs are quickly full and hub generally got a small backplane, so they can't manage too much packet at the same time. ... to best put together a segmented LAN using multiple switches on one ...
      (microsoft.public.windows.server.networking)