Re: about mirroring port

From: Joe Magee <lists(at)joemagee.com>
Date: Thu Mar 20 2003 - 02:36:18 EST

>also keep in mind port mirroring on a switch for the most part isn't

In practice, some of the higher end switches yielded the same results.

>was trying to mirror ports that were uplinked to other switches,

For low bandwidth applications using a standard L2 switches "SPAN" port feature may work. For multiple simultaneous copies of traffic take a look at the Top Layer IDS Balancer. It's a very mature product. I used it in my previous jobs for doing both balancing, making multiple simultaneous copies of traffic, and splicing off applications.

For more on the topic check out: http://www.joemagee.com/filez/Why%20not%20use%20a%20switch.pdf

>> 1. when I setup the mirroring port,all traffic(for example, port2 traffic)

Joe Magee
http://www.joemagee.com

---

ALERT: Exploiting Web Applications- A Step-by-Step Attack Analysis Learn why 70% of today's successful hacks involve Web Application attacks such as: SQL Injection, XSS, Cookie Manipulation and Parameter Manipulation.
http://www.spidynamics.com/mktg/webappsecurity71 Received on Sun Mar 23 23:55:30 2003