Duplicating a span port (copper tap?)

Unanswered Question
Jan 20th, 2010

We have a Cisco 3750 that has a span port setup, to mirror traffic from all the other ports.  Right now we have our IDS connected to that span port.  But we now have a need to have a second device see that same traffic.  In the old 10/100 days we could probably have used a hub.


But in a gigabit world, how do I let two devices see that span traffic?  I found some gigabit taps, but they seemed to be designed to sit inline between two devices, not necessary to just duplicate a single port (which would come from my SPAN). But maybe they would work anyway?


http://www.blackbox.com/Store/Detail.aspx/10-100-1000-Copper-Aggregator-Tap-256-MB-Buffer/TS254A

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
billmatthews Thu, 01/21/2010 - 06:57

Hi Sal,


Thanks!  But I'm already familar with how to setup a SPAN port.  We've got one setup and running just fine now.  But we're looking to take that single SPAN port and get the traffic to two hosts.


I realize I could setup two SPAN ports, but we're running low on physical ports on our switch.  So I'm looking for advice on hardware to "split" the SPAN port into two devices.

Giuseppe Larosa Thu, 01/21/2010 - 07:14

Hello Bill,

you could add another switch to move some users there so that you can add a second SPAN destination port.


This looks like more useful on the long term.


Taps are usually proposed as alternative to SPAN sessions.


Be aware that spanning all ports to a single GE can cause problems: some traffic can be lost and switch cpu usage can become high when there is high  oversubscription of the destination port(s).


Hope to help

Giuseppe

Actions

This Discussion