-----Original Message-----
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]On Behalf Of Derek Nelson
Sent: Wednesday, October 08, 2003 1:48 PM
To: 'Ganesharatnam C'; [EMAIL PROTECTED]
Subject: RE: [ISSForum] GB Uplinks...How many servers do you have? Not knowing anything about your network, it may be more cost effective to put server sensors on your sensors instead of using network sensors. Or do they have non-supported OS's? You could use a Guard/Proventia G Series in these cases perhaps (although still only 100mbps but apparently a gig version is coming...?)
Alternatively you could use Proventia A 1204 which has 4x10/100/1000 monitoring interfaces, with a total throughput of 1200mbps - It all depends on how much your links are utilised. Please supply more info - like, what the link utilisations on the gig uplinks is. Did you want to use RSKills ?
Cheers,
- Derek.
>-----Original Message-----
>From: Ganesharatnam C [mailto:[EMAIL PROTECTED]]
>Sent: Thursday, 9 October 2003 10:52 a.m.
>To: [EMAIL PROTECTED]
>Subject: [ISSForum] GB Uplinks...
>
>
>Hi there,
>
>I would like to seek some advise from the forum hoping some
>may come across
>these before.
>
>Usually in most current setup, there will be core switches and
>these core
>switches will be connected to multiple VLANs using a fiber GB
>connection to
>edge switches.
>
>Nowadays many customers have request of such they want to
>monitor the VLANs
>and they can be having right up to 10 dedication GB links to the edge
>switches. For this requirements, we can recommend a few ways.
>
>1. Install GB Network Sensors for each link coming into the
>core switch,
>meaning, we port mirror the connection to the edge switches at
>the core.
>(example with 10 GB links and edge switches)
>
>adv
>===
>- We can view traffic for all VLANs.
>- Deployment will be not as complicated.
>
>disadv
>======
>- There will be 10 GB NIDS for every single connection.
>- Our customers usually will disagree to this as the cost will
>be extremely
>high.
>
>2. Besides port mirroring we can also place a tap to gather
>traffic pattern
>and analyse them.
>
>disadv
>======
>- add a price of a tap to the list
>
>I am looking at some feasible way whereby the customers will
>consider the
>cost to purchase at least some rather than nothing at all.
>
>If you look at the environment above, I would like to seek
>advise for the
>below ideas which i hope to get some feedback from you people;
>
>1. Placing a normal 10/100 network sensor at each edge switch
>connecting to
>the core, some how rather mirroring the GB uplink to a UTP port.
>
>adv
>===
>- We can definitely sell 10 NIDS in this way
>- We still can capture traffic movement
>- Deployment will not be as much complicated.
>
>disadv
>======
>- I do not know how can the switch support such a downgrade *advise*
>- There will be definite packet loss, to what extend I do not
>know *advise*
>
>2. Placing a tap which has the ability to take in GB traffic
>and output to a
>Ethernet traffic. We just plug a normal 10/100 Network sensor
>to the output
>for monitoring.
>
>adv
>===
>- A tap can out perform a switch
>- The cost will still be justifiable
>disadv
>======
>- Still the issue of packet loss comes to play *advise-how
>much ?*, queues,
>buffers... etc...
>
>3. At the core switch we port mirror 2-4 uplinks to a GB
>sensor. Port mirror
>4 GB to a single GB.
>
>adv
>===
>- Instead of 10 GB sensors, I may just only need 2-3 GB
>sensors to do the
>trick.
>
>disadv
>======
>- 8GB full duplex to 2GB full duplex. 4 ports to 1 This does
>not sound good
>*advise*
>- Packet loss, core switch utilisation, not to mention whether
>the switch is
>capable to perform such a function *advise*
>- Can the sensor itself handle this much of load, say we make
>it a really
>high end server *advise*
>
>4. This might not be workable at all but I am giving a shot!,
>Can a single
>sensor have multiple monitoring port... ehhrmm with one GB
>sensor license ?.
>
>Thanks
>Ganesh C
>
>
___________________________________________________________________________________________________________________________________________________________________
This mail is protected by Silicon Communications S/B The information contained in this message maybe confidential and protected from disclosure. If you are not the intended recipient of this message, please delete this message immediately. You are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. ~~~This email has been scanned by our anti-virus system. For precaution, please make sure you scan every attachment in this email. Please use at your own risk. Thank you. :) Mailadmin~~~ ___________________________________________________________________________________________________________________________________________________________________
