promiscuous port on a switch?

jdepies · ‎02-24-2004

Hello, I want to install an IDS solution that needs to have access to all traffic on the LAN. All of my machines plug directly into a 3550 catalyst switch running IOS Version 12.1(13)EA1a.

Is there any way to have a copy of all data sent to a spicific port on the switch (almost like a mirror port). Sorry I am not sure what the appropriate terminology is.

Thanks a lot

Jeff

anu · ‎02-24-2004

Its called port monitoring for IOS based switches. Below you can find a guide for configuring SPAN on a 3550 switch.

http://www.cisco.com/en/US/products/hw/switches/ps646/products_configuration_guide_chapter09186a00801f0a55.html

grunky · ‎02-25-2004

The thing to remember is that once a switchport is in destination span mode it won't forward normal traffic. ie you'll need two physical nics plugged into different switchports for a IDS box. Either that or just access the IDS box via console only.

More secure but a pain.