[c-nsp] Re: Sniffing DS3's Ideas??

[Roger Weeks]

At a previous gig we used Network General (then Network Associates)  
Sniffer Portable:

http://www.networkgeneral.com/Products_details.aspx? 
PrdId=20046243936754&CatId=1

It's not cheap by any means, but they do offer DS3, OC-3 and OC-12  
interfaces among others.

If you're looking for DS3 PCI interfaces, there are models like this  
that are marketed by the VoIP vendors:

http://www.telephonyware.com/telephonyware/tw00170.html?mv_pc=A00015

Looking at the specs, it will do various types of IP and ATM  
transport so it might be worth looking at.

If neither of those are viable options, you could always get yourself  
an ATM switch with two DS3 modules and an OC-3 module.  Connect your  
uplink to one DS3, the router to the other DS3, and purchase an OC-3  
PCI card for your sniffer:

http://store.yahoo.com/technomages/marconihe155.html

Set up the switch so that the OC-3 is a mirror port for the uplink  
port, and sniff.

--
Roger J. Weeks
Systems & Network Administrator
Mendocino Community Network

> Date: Mon, 14 Nov 2005 08:27:48 -0800
> From: Adam Piasecki <apiasecki at gmail.com>
> Subject: [c-nsp] Sniffing DS3's Ideas??
> To: cisco-nsp at puck.nether.net
>
> Right now we have two routers and a hub in between, This provides a  
> couple of reliability problems, Ideal what I would like is a DS3  
> TAP example: (http://www.netoptics.com/products/application.asp? 
> ts_id=&cid=1&pid=48&Section=products&menuitem=1)
>
> I can't seem to find DS3 PCI Cards, do they make them? Would they  
> work with ethereal/snort? Any other solutions other ISP's are using  
> would be great.
>
>
> Current Soultion
> 7507 -> Hub -> 7206 -> DS3 (Internet)
>              |
>              |
>           Sniffer/IDS System
>
>
> New Soultion
> 7507 -> 7206 -> DS3tap ->  DS3 (Internet)
>                             |
>                             |
>                          Sniffer/IDS System
>