TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message to
[EMAIL PROTECTED]  Contact [EMAIL PROTECTED] for help with any problems!
----------------------------------------------------------------------------

If you are seeing traffic it is probably setup correctly.  The problem with
span ports is more a case of overloading the port. For instance set span
12-14 1 would copy the traffic from 12,13,14 to port 1 obviously 300 mbps is
not going to go down a single 100 mbps.

brian


-------------------------------------------------------------------
Brian Laing
Product Manager - Intrusion Detection Technologies
Internet Security Systems
UK Cellphone: +44 (0)771 264 5559
US Cellphone: +1     404 391 0589
UK Telephone: +44 (0)199 253 5918
US Telephone: +1     404 236 2709
US eFax:             208.575.1374
Internet Security Systems -- The Power to Protect

http://www.iss.net
-------------------------------------------------------------------

 -----Original Message-----
From:   KDouble [mailto:[EMAIL PROTECTED]] 
Sent:   Friday, April 20, 2001 12:02 PM
To:     'Ronald Petrucci'; [EMAIL PROTECTED]
Cc:     '[EMAIL PROTECTED]'
Subject:        RE: 


TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message to
[EMAIL PROTECTED]  Contact [EMAIL PROTECTED] for help with any
problems!
----------------------------------------------------------------------------

We set up the spanning and connected the monitoring nic, I guess I was
expecting to see more traffic than I do.  I was just concerned that it may
not be spanned appropriately.  Now that I know it at least supports it, I
need to go back and double check the settings.

Any tips on tweaking or checking the spanned port?

 -----Original Message-----
From:   Ronald Petrucci [mailto:[EMAIL PROTECTED]] 
Sent:   Thursday, April 19, 2001 8:44 PM
To:     [EMAIL PROTECTED]
Cc:     KDouble; '[EMAIL PROTECTED]'
Subject:        Re:



Ray & Ken

I have Real Secure 5.0 NT operating in a switched environment without the
Network TAP.  All we did was
ensure that port spanning was enabled at the switch .... the sensor then
began
to see all traffic.
We also looked at the Shomiti Tap as a possible solution and found it to be
good
but very costly.

Ron





Ray Honeycutt <[EMAIL PROTECTED]> on 04/19/2001 04:57:38 AM

Please respond to [EMAIL PROTECTED]

To:   KDouble <[EMAIL PROTECTED]>
cc:   "'[EMAIL PROTECTED]'" <[EMAIL PROTECTED]> (bcc: Ronald Petrucci/FTCI)
Subject:  Re:





TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message to
[EMAIL PROTECTED]  Contact [EMAIL PROTECTED] for help with any
problems!
----------------------------------------------------------------------------

I'm not sure if you received a good answer to your question, but I recall
about
a
year ago several customers indicated that they use RS in a switched
environment
with a network tap.  This avoids the problems associated with port mirroring
on
a
switch.  I know Shomiti (www.shomiti.com) makes the leading network tap on
the
market.  We have used their taps in a number of networks for protocol
analysis
and they work great.

KDouble wrote:

> TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message
to
> [EMAIL PROTECTED]  Contact [EMAIL PROTECTED] for help with any
problems!
>
----------------------------------------------------------------------------
>
> Does anyone have ISS Real Secure Network Sensor 5.0 working in a spanned
> switch environment?
>
> Ken

----------------------------------------------------
Ray Honeycutt                      919.779.3055 Voice
President                          919.779.3464 Fax
HCS Systems Inc.                 www.hcssystems.com
Suite E                          [EMAIL PROTECTED]
1428 Aversboro Rd.
Garner NC 27529, USA












Reply via email to