TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message to
[EMAIL PROTECTED] Contact [EMAIL PROTECTED] for help with any problems!
----------------------------------------------------------------------------
Hi there again
Thanks a lot for all your most appreciated tips and tricks to merge the
switched segments.
I now will most likely get a Finisar (Century) 12-Port Tap to do the job
(it's not even as expensive as expected... ;-).
Most segments we would like to monitor are low-bandwith (WAN, RAS)
segments, so the risk that the IDS interface gets overloaded is relatively
small for us.
I also considered to do something like Allen (below) has recommended,
namely, to just take a 'regular' Cisco switch to collect the traffic.
The problem here is, that this theoretically poses a new security risk
regarding hacking and traffic mix.
For example, if you want to monitor the traffic of a DMZ segment, you
physically connect the DMZ switch to this 'IDS-Switch', and therefore, in
worst case, create a new path for hacking into the whole thing (first hack
the IDS switch, and then climb on to the backbone...). Not to say that this
is likely, but you also heard about all this SNMP vulerabilities etc... ;-)
So, with a 'professional' Multiport Tab, i hope that such 'cross-hacking'
activities are simply not possible, and that there is no possible path
between the monitored segments just because of the traffic monitoring.
Anyway, again, thanks a lot!
Andres
"Witt, Allen"
<DAVID.A.WITT@sa To: Andres
Friedli/CH/GTS/PwC@EMEA-CH
ic.com> cc:
Subject: RE: How to merge several
switched LAN segments
16.04.2002 16:16
Suggestion configuration, provided that you have funding......
Purchase the following: 1 12 port Cisco switch (3000 series recommended)
with Gigabit uplink, GBIC, and a Gigabit fiber card for your sensor.
Configure span ports on each of your existing Cisco switches and connect
these ports to the new switch.
Configure spanning on the new switch to span the traffic to a gigabit port,
which will be connected to your sensor.
If the traffic loading on the existing switches aggregates to less than 75
mbs, you could drop the gigabit items and span to a 100-base-T port,
connected to your sensor. You definitely can't use a hub for this....
aw
-----Original Message-----
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]
Sent: Monday, April 15, 2002 3:29 AM
To: [EMAIL PROTECTED]
Subject: How to merge several switched LAN segments
TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message to
[EMAIL PROTECTED] Contact [EMAIL PROTECTED] for help with any
problems!
----------------------------------------------------------------------------
Hi there
I am looking for a trick to merge the traffic of about 5 switched Fast
Ethernet LAN segments together in order to monitor the total traffic with
only one RS Network Sensor. Most of the LAN segments are on different
physical switches (DMZ, RAS, WAN Segments), but in the same physical
location.
All links are Full-Duplex - and we would like to keep that up to the IDS
Interface (to prevent packet loss due to collisions).
All this traffic should then be collected on a single 'IDS-Switch', which
then mirrors all the incoming segments/traffic to the IDS interface port.
As this IDS switch (Cisco 2924) does not support *unidirectional* port
mirroring (SPAN), we need another solution to prevent the mix-up or
backflow of traffic to the source switches (also for security reasons).
I've heard something about cutting the TX lines in the Twistet-Pair patch
cables that lead to the IDS switch, to prevent the back-flow of traffic.
Has anyone done this already, and if so, how do I trick the switch to keep
the port 'up', despite the cut TX line?
Any other ideas or tricks to merge multiple switched LAN segments onto the
IDS network interface?
Many thanks!
Andres
----------------------------------------------------------------
The information transmitted is intended only for the person or entity to
which it is addressed and may contain confidential and/or privileged
material. Any review, retransmission, dissemination or other use of, or
taking of any action in reliance upon, this information by persons or
entities other than the intended recipient is prohibited. If you received
this in error, please contact the sender and delete the material from any
computer.
----------------------------------------------------------------
The information transmitted is intended only for the person or entity to
which it is addressed and may contain confidential and/or privileged
material. Any review, retransmission, dissemination or other use of, or
taking of any action in reliance upon, this information by persons or
entities other than the intended recipient is prohibited. If you received
this in error, please contact the sender and delete the material from any
computer.
