[nsp] re: Span on multiple switches

[Dave Wardle, Critical Networks, Inc.]

> Hello,
>
> A quick question regarding span:  I have multiple switches trunked
together,
> say  a---b---c---d---e.
> If I have multiple vlans configured on the switches, but I am trunking
them
> all the way through my network, how could I configure monitoring
> on switch E to recieve all traffic from all switches?  I was thinking I
> could monitor everything on each switch, and then set the monitor port as
> the trunk port.
> My concern then is with overloading the trunk.  Is there a standard way to
> do this?  Appreciate any advice.
>
> Thanks,
>
> Tim

The rspan feature might meet your requirements, but if you have significant
traffic levels on your LAN you may need to explore some alternative options
using physically separate monitoring infrastructure. The following URL links
to a whitepaper on "Scalable network sniffing for IDS and Network Analysis"
that you might find useful:

http://inetd.com/CriticalNetworks/resources/index.html

Let me know what you think.

Cheers
Dave