It's just a pod. There's no other word for it!? ;-) It's a box about the
size of a small notebook computer that inserts in-line on a UTP or fiber
full-duplex link between switches, or between a switch and a server, so you
can capture both channels at once. Without a pod, to sniff on a full-duplex
link, you have to first set the ports to half-duplex and insert a hub and
attach the analyzer to the hub. This affects performance and requires
downtime while reconfiguring.
You can leave these pods in place (if you have enough of them, and they are
expensive, so that's an issue.) Or you can quickly break a link and insert
the pod before doing analysis.
There are caveats, such as the ability to quickly overflow the analyzer's
buffer. Frames can get out of order also. How well does the analyzer
provide high-level info on sessions if clients are sending to the server at
essentially the same time the server is responding? What is the time
resolution on the analyzer? Can it correctly time stamp client/server
traffic that is happening essentially simultaneously?
Priscilla
At 12:56 PM 6/27/01, Jack Nalbandian wrote:
>Wait, what device is the "thingie/podmaker"?
>
> Priscilla wrote:
>
> I just finished writing some information on pods in the protocol
> analysis
> world. In that case, a pod is an extra little thingie (technical
> term) that
> helps the analyzer get on the network. With full-duplex links,
> for example,
> if you don't want to break the link and put in a shared hub for
> attaching
> the analyzer, you can get a so-called pod that leaves the link at
> full-duplex traffic and buffers traffic before sending it to the
> analyzer.
> These pods are costly.
________________________
Priscilla Oppenheimer
http://www.priscilla.com
Message Posted at:
http://www.groupstudy.com/form/read.php?f=7&i=10194&t=10194
--------------------------------------------------
FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html
Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
