Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

IDSM inspection load on 100%

Now I have IDSM with 100% inspection load on busy hour and followed by missed packets percentage increasing at that time. 

The IDSM interface is setting as promiscuous interface

Is it means my network throughput will limited by IDSM max inspection load / throughput which is 600Mbps?

 

Thank you

 

Marcel.

1 ACCEPTED SOLUTION

Accepted Solutions
VIP Purple

No, the throughput wil not be

No, the throughput wil not be limited in the network when you are in promiscous mode. But your visibility for attacks is highly limited.

You should configure your span/capture settings on the 6k5 to only send as much traffic to the IDSM as this module can handle.

Just remember that the IDSM-2 is a ten years old system and can't catch up with the typical traffic-demand we are having nowadays. It's time to change the IDSM against an actual external sensor.

--
Don't stop after you've improved your network! Improve the world by lending money to the working poor: http://www.kiva.org/invitedby/karsteni
2 REPLIES
VIP Purple

No, the throughput wil not be

No, the throughput wil not be limited in the network when you are in promiscous mode. But your visibility for attacks is highly limited.

You should configure your span/capture settings on the 6k5 to only send as much traffic to the IDSM as this module can handle.

Just remember that the IDSM-2 is a ten years old system and can't catch up with the typical traffic-demand we are having nowadays. It's time to change the IDSM against an actual external sensor.

--
Don't stop after you've improved your network! Improve the world by lending money to the working poor: http://www.kiva.org/invitedby/karsteni

Thank you Karsten, I will

Thank you Karsten, I will plan to change the IDSM 

63
Views
0
Helpful
2
Replies
CreatePlease login to create content