Not sure what you mean by one nic monitoring and one nic in stealth mode. Usually your monitoring nic should be the one in stealth mode. Maybe you meant one management nic and one monitoring (stealth) nic.
Anyway on a Cisco 3550 when you setup a SPAN port you must enter the below command to allow the SPAN port to except spoofed RSKILL packets back in the SPAN port. incoming packet enable or inc pac ena in the SPAN properties will enable you to monitor and do TCP resets from the same cable back into the SPAN port and injected back into the network. Hope that helps. DMZSecure On Tue, 22 Mar 2005 17:15:42 -0300, Paula Rodrigues - daydreams <[EMAIL PROTECTED]> wrote: > Hi , > > I have a sensor that monitor my DMZ , and I have only two NIC's and my > switch is a 3550. > I use one Nic to monitoring and the other in "stealth" mode . Can I send > RSKILL through the port span of the switch 3550? > > Thanks a lot ! > > M.Eduarda > > _______________________________________________ > ISSForum mailing list > [email protected] > > TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to > https://atla-mm1.iss.net/mailman/listinfo/issforum > > To contact the ISSForum Moderator, send email to [EMAIL PROTECTED] > > The ISSForum mailing list is hosted and managed by Internet Security Systems, > 6303 Barfield Road, Atlanta, Georgia, USA 30328. > _______________________________________________ ISSForum mailing list [email protected] TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to https://atla-mm1.iss.net/mailman/listinfo/issforum To contact the ISSForum Moderator, send email to [EMAIL PROTECTED] The ISSForum mailing list is hosted and managed by Internet Security Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328.
