Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
New Member

VACL vs Span for IDSM

I currently have an IDSM blade installed in my 6509 and am using span. I am recieving a lot of 933 alerts due to dropped/missed packets. I wanted to know if using vacl was a better way of capturing the data to be looked at with the IDSM. If so, where would I find some good docs on how to set this up.

I am assuming that span is the reason for the lost/missing data. If there is another more logical solution for the 933 events please let me know.

Thanks

1 REPLY
New Member

Re: VACL vs Span for IDSM

Normally dropped/missed packets alarms are the result of oversuscription. If you decide on directly collecting information from a specific VLAN, it is possible to oversubscribe there too and therefore drop packets which may cause alarms. All the same, a good document on using VACL for capturing data to be looked at by the IDSM is located at http://www.cisco.com/univercd/cc/td/doc/product/iaabu/csids/idsm/idsm_1/10890_02.htm#xtocid56619.

103
Views
0
Helpful
1
Replies
CreatePlease to create content