Re: [ISSForum] SPAN port for IDS monitoring - Cisco switches

[Bob Fischer]

I just ran into this problem on my Cisco switches. We were monitoring all traffic using the span port on the switch with no problem. A Cisco IOS upgrade on the 4000 switch required us to change the network sensor configuration. It seems the new Cisco IOS could only span in promicious mode, whereas before the upgrade the span port had an IP address (we issued IP kills through it) We were forced to add another interface to the network sensor; one to 'span' or 'listen' and the second to issue IP kills.   Your sitches may be at the weird Cisco IOS level.   Hope this helps....