I recently received an IDSM-2 blade for my Cat6K. One setup problem I had was I couldn't find documentation anywhere on how the sensor ports are used. I'm posting this note in the hope it saves someone else some time.
The IDSM-2 blade appears to the 6K to have 8 ports:
Port Name Status Vlan Duplex Speed Type
----- -------------------- ---------- ---------- ------ ----- ------------
6/1 connected trunk full 1000 Intrusion De
6/2 connected 251 full 1000 Intrusion De
6/3 disable 1 full 1000 Intrusion De
6/4 disable 1 full 1000 Intrusion De
6/5 disable 1 full 1000 Intrusion De
6/6 disable 1 full 1000 Intrusion De
6/7 monitor trunk full 1000 Intrusion De
6/8 connected trunk full 1000 Intrusion De
Port x/2 is the command and control port. On the 6K, set this port to a VLAN appropriate to the IP address you give the sensor. Don't use VLAN 1, which is the default. Ports x/7 and x/8 are the sniffing ports. Use either SPAN or VACL to direct traffic to these ports. x/7 is active by default; I'm not sure about x/8. Note that x/7 and x/8 by default have all VLANs set, so they can listen to anything you send them. (You don't really need two sniffer ports; there are two because of the blade's architecture.)
Lastly, I'm told that x/1 is used to send TCP reset packets. Again, it has all VLANs set by default, so it can pick the correct one. This use of x/1 differs from what I heard earlier in the week at Networkers 2003, so I'd appreciate if someone could confirm it.
/Chris Thomas, UCLA
