Re: Techniques for passive traffic capturing

2008-06-25 Thread Matt Cable
Ross Vandegrift kallisti.us> writes: > > On Tue, Jun 24, 2008 at 01:19:03PM +1200, Nathan Ward wrote: > > I see little point in aggregating tapped traffic, unless you have only > > a small amount of it and you're doing it to save cost on monitoring > > network interfaces - but is that saved

Re: Techniques for passive traffic capturing

2008-06-24 Thread Ross Vandegrift
On Tue, Jun 24, 2008 at 01:19:03PM +1200, Nathan Ward wrote: > I see little point in aggregating tapped traffic, unless you have only > a small amount of it and you're doing it to save cost on monitoring > network interfaces - but is that saved cost still a saving when you > factor in the cos

Re: Techniques for passive traffic capturing

2008-06-24 Thread Justin Shore
I stumbled across these last night. http://www.dovebid.com/assets/display.asp?ItemID=cne11811 I don't know anything about them and haven't done any research. The auction description would however lead me to believe that they might be useful in this case. There are many of them listed in the

Re: Techniques for passive traffic capturing

2008-06-24 Thread Ross Vandegrift
On Mon, Jun 23, 2008 at 10:00:06PM -0500, Kevin Kadow wrote: > We started out with SPAN ports, then moved on to Netoptics taps. > > Lately we've been using a combination of Cisco Netflow (from remote routers), > and native Argus flows (from local taps) where we need more details. > > Flows are us

Re: Techniques for passive traffic capturing

2008-06-23 Thread Kevin Kadow
We started out with SPAN ports, then moved on to Netoptics taps. Lately we've been using a combination of Cisco Netflow (from remote routers), and native Argus flows (from local taps) where we need more details. Flows are useful to answer "What happened X minutes/hours/days ago?", and where you d

Re: Techniques for passive traffic capturing

2008-06-23 Thread Nathan Ward
On 24/06/2008, at 8:32 AM, Ross Vandegrift wrote: I've been thinking about a move to a system based on optical taps of each of the links. I'd aggregate these links into something like a 3750 and use remote-span VLANs to pass the traffic onto servers that sniffing on their interface on that 3750.

Techniques for passive traffic capturing

2008-06-23 Thread Ross Vandegrift
Hello everyone, Over the past two years, there's been a trend toward doing more and more analysis and reporting based on passive traffic analysis. We started out using SPAN sessions to produce an extra copy of all of our transit links for these purposes. But the Cisco limits of two SPAN sessions