TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message to [EMAIL PROTECTED] Contact [EMAIL PROTECTED] for help with any problems! ----------------------------------------------------------------------------
Please note that: 1. This e-mail may constitute privileged information. If you are not the intended recipient, you have received this confidential email and any attachments transmitted with it in error and you must not disclose, copy, circulate or in any other way use or rely on this information. 2. E-mails to and from the company are monitored for operational reasons and in accordance with lawful business practices. 3. The contents of this email are those of the individual and do not necessarily represent the views of the company. 4. The company does not conclude contracts by email and all negotiations are subject to contract. 5. The company accepts no responsibility once an e-mail and any attachments is sent. Allasso Ltd Theale House, Brunel Road, Theale, Berkshire RG7 4AQ UK T: +44 118 971 1511 F: +44 118 971 1522 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi. I'm sure TopLayer can deal with this. It's not a product we carry and therefore I'm not trained on it but one of my ex-colleagues went to work at Integralis and they do sell and support it. It was a while ago we were chatting but I'm sure it integrates with RealSecure and handles Switched networks a dream. I have seen posts from TopLayer staff on this list (Simon Edwards) so you can either wait for a response from them, contact TopLayer or get in touch with my ex-colleague at [EMAIL PROTECTED] Kind Regards, Jon Paine. Technical Lead. Allasso European Support Centre. SMTP - mailto:[EMAIL PROTECTED] WEB - http://support.allasso.com Tel. 0870 366 8533 (+44 118 971 1533) Fax. 0870 366 8544 (+44 118 971 1544) PGP Fingerprint: ADD3 07AC ED47 292A BF61 E124 E81F 9249 7AD9 6E0C > -----Original Message----- > From: Jason Renard [mailto:[EMAIL PROTECTED]] > Sent: 15 April 2002 20:38 > To: [EMAIL PROTECTED] > Cc: [EMAIL PROTECTED] > Subject: Re: How to merge several switched LAN segments > > > > TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of > your message to > [EMAIL PROTECTED] Contact [EMAIL PROTECTED] for help > with any problems! > -------------------------------------------------------------- > -------------- > > On Mon, 15 Apr 2002 09:29:10 +0200, you wrote: > > >I am looking for a trick to merge the traffic of about 5 > switched Fast > >Ethernet LAN segments together in order to monitor the total > traffic with > >only one RS Network Sensor. Most of the LAN segments are on > >different physical switches (DMZ, RAS, WAN Segments), but in the > >same physical location. > > Watch out for how much load you have on these segments compared to > how much you can monitor, in terms of (a) whatever you use to > 'merge' the traffic (b) the NIC on your network sensor (c) the CPU > on your network sensor. > > >All links are Full-Duplex - and we would like to keep that > up to the IDS > >Interface (to prevent packet loss due to collisions). > > Ok, here when you say "IDS interface" you don't necessarily mean > the network sensor NIC do you? You mean whatever device / > technology is used to merge the five full duplex ethernet > connections into one > stream? > > >All this traffic should then be collected on a single > 'IDS-Switch', which > >then mirrors all the incoming segments/traffic to the IDS > interface port. > > I assume you've done the maths, such that it is theoretically > possible to merge the total network traffic of your five full > duplex segments out on to a single wire? After all, whatever device > you use to merge the traffic, if you've only got ONE network sensor > then it will only be able to process the traffic on its RECEIVE > wire which is > essentially half-duplex. (In other words, even if you combine 200 > Mbps of full-duplex traffic, when you squirt it at the sensor it > will be down a wire rated at 100 Mbps - and that's assuming 100% > utilisation). > > As a technical aside I believe Network Sensors support more than > one NIC (possibly two, not sure if three's official) so if you had > a > single full-duplex wire to be monitored then you could tap both > directions and feed each into a NIC on the same network sensor - > although of course (a) would both be loading the CPU etc on the > sensor (b) would lose some functionality because each NIC's would > be examined separately and you'd have problems with 'syn flood' > detection etc. > > Incidentally i've not dabbled with dual sniffing NICs on a Network > Sensor so don't take anything i've just said as the word of an > experienced man! > > >As this IDS switch (Cisco 2924) does not support > *unidirectional* port > >mirroring (SPAN), we need another solution to prevent the mix-up > >or backflow of traffic to the source switches (also for > security reasons). > >I've heard something about cutting the TX lines in the > Twistet-Pair patch > >cables that lead to the IDS switch, to prevent the back-flow > of traffic. > >Has anyone done this already, and if so, how do I trick the > switch to keep > >the port 'up', despite the cut TX line? > > I've heard of cutting the TX line but haven't done so myself. > > Interesting, yes, I'd never thought what the switch would do in > that case - hopefully some other readers will have done this and > know. > > I am a little confused here - is the Cisco 2924 a normal switch > without SPAN, or does it have SPAN abilities but you can't > customise it to prevent injection of packets? > > You can buy "wire taps" which are little boxes that you can think > of as going instream into an ethernet cable and presenting copies > of both the wires to you. I think they're called Schomiti or > something like that. For example you could plug a cable between > your switch and the tap, then take one of the feeds and connect it > to your sensor. The only thing I'm not sure of is whether the tap > would needed to be > connected to something else, properly, since it's designed to sit > "instream". I've not used these taps so, once again, am only > talking from what i've picked up from others. > > >Any other ideas or tricks to merge multiple switched LAN > segments onto the > >IDS network interface? > > "Top Layer" switches used to be mentioned a lot alongside ISS - > I've never used them but apparently they can take multiple feeds > and > present them to a network sensor or stripe them across several > sensors. Again, i should say that i've not used these switches > personally. > > >Many thanks! > >Andres > > Don't forget... > > - if you use a span port to combine multiple segments, make sure > that span port can handle the combined amount of traffic > > - make sure the final wire to the network sensor, and the sensor > itself, can handle the final amount of traffic > > - if you split TX and RX to different sensors then you will lose a > little functionality > > - bear in mind whether now, or in the future, you might want the > ability to send TCP resets > > Um, that's it for now... > > Jason > Jason Renard > > Warning - all views expressed are my own. > I cannot guarantee the accuracy of everything > I've said - use it at your own risk. > > -----BEGIN PGP SIGNATURE----- Version: PGP 7.1 iQA/AwUBPLvgRugfkkl62W4MEQLGhwCfcM7eZAjnBtqlyxm5faHd6Qbv7/sAoOiy /g2v9DuVIJupvSFyRC6qfXme =+dyi -----END PGP SIGNATURE-----
