I hav2 2 6509 switches which are working as core switches.In each 6509 i have IDSM-2 module.The Aggregation 6509 switches are doing the routing for the vlans and connected to core 6509 from where traffic exit for wan & internet.
In my IDSM2 i am planning to capture the traffic of uplink ports coming from Aggregation to core .which mode of IDSM would be preferred.
can i connect the workstation to capture the IDSM events.will the workstation and management vlan id of idsm should be in same subnet or it can be in diffrent subnet and reachable via routing.
I have 2 data ports on the cards so all uplinks traffic should be captured to both data ports or divided among 2 data ports.
will the vlan monitoring would be better option than physical uplink port monitoring
pl share any sample config available for the same???