RE: Port mirroring across multiple switches

• Previous message: Camp, Mr Tony J.: "RE: Messenger service abuse (from inside the network)"
• In reply to: Hasnain Atique: "Port mirroring across multiple switches"
• Next in thread: Thomson, Stuart A.: "RE: Port mirroring across multiple switches"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

To: "'Hasnain Atique'" <hatique@hasnains.com>, <security-basics@securityfocus.com>
Date: Fri, 5 Dec 2003 09:19:32 -0600

 I wouldn't do that. You'll run into layer 2 loop issues I'm thinking.
You'll see some especially nasty stuff if you have spanning tree on.

-Tim

-----Original Message-----
From: Hasnain Atique [mailto:hatique@hasnains.com]
Sent: Thursday, December 04, 2003 4:23 AM
To: security-basics@securityfocus.com
Subject: Port mirroring across multiple switches

What's the best approach to port mirror traffic from multiple switches?
Should I enable mirroring on one port of each switch, and then connect
those ports to a hub and put my sniffer on the same hub?

My ultimate objective is to collect ARP query information from all
switches.

Thanks.

-- H

---------------------------------------------------------------------------
----------------------------------------------------------------------------

---------------------------------------------------------------------------
----------------------------------------------------------------------------

• Previous message: Camp, Mr Tony J.: "RE: Messenger service abuse (from inside the network)"
• In reply to: Hasnain Atique: "Port mirroring across multiple switches"
• Next in thread: Thomson, Stuart A.: "RE: Port mirroring across multiple switches"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]