Port Mirroring

Unanswered Question
Mar 24th, 2009


We have a 6509 with a lot of T1 or T3 circuits on it from different spoke sites. We also have an IDS connected on that 6509. How do you do port mirroring on that 6509 so IDS can catch traffic between the spoke sites? SPAN will not work because it is not layer 2 port mirroring. Thanks!

I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
mchin345 Mon, 03/30/2009 - 14:40

Port mirroring is used on a regular basis in lab as well in production to capture voice traffic. Often time port mirroring causes duplicate packets. I don't see a particular pattern. Sometimes it doesn't happen at all, sometimes only few packets are duplicated while at other times all packets are duplicated. This causes problems in data analysis. I would appreciate if you could look into this and if necessary put a ticket to Cisco to get a fix for this problem.


This Discussion