port mirroring on a switch

[oddyager]

Can port mirroring be used to monitor an interface on a different switch? Say there's a machine thats hooked up directly to the backbone and I want to be able to monitor packets from that port on a port thats on our closet switch.

 

[cmetz]

no

 

[spidey07]

If it's cisco you can.

It's called RSPAN. Comes in handy. You can mirror ports/vlans and send them to any other switch you like.

Other manufacturers may have this, I don't know. You would think they would?

 

[cmetz]

I can see how this is convenient, but it adds a lot of implementation complexity, and therefore ways to introduce problems or not work as expected.

 

[cross6]

comes in handy for IDS

 

[oddyager]

Originally posted by: spidey07
If it's cisco you can.

It's called RSPAN. Comes in handy. You can mirror ports/vlans and send them to any other switch you like.

Other manufacturers may have this, I don't know. You would think they would?

Yes, they are all Cisco switches. Thanks. I'll check that out.

 

[n0cmonkey]

Originally posted by: cross6
comes in handy for IDS

You should be using taps.

 

[cmetz]

yeah, netoptics.

 

[oddyager]

Hmm, this isn't working as well as I wanted, heh. If I try monitoring the destination port I have configured (using Ethereal), it seems to pick up traffic thats all over that vlan and not the port I'm monitoring. Is this configured right?

EDIT: I'm an idiot. Nevermind. The other traffic I was seeing were just broadcasts.