RE: future of IDS

["Brock, Todd" <brockt () uf9370p01 OrlandoFL ncr com>]

        >> If you have a switch with 24 ports for 100BaseT, can you then
push 1.2Gb/s
        >> through it ?

        >I believe you can push 1.2 Gb/s through it.  Doubtless someone on
the
   >list knows for sure.

Depends on the switch, but the good ones should be able to handle this, with
a "real world" load, non-blocking Blah-Blah...

        >> if you have a single 100BaseT monitor port, either than
throughput for the
        >> entire switch is 100BaseT (serious reduction in performance) or
you lose
        >> packets on the monitor port.

        >Yep.  Don't know if there are switches with higher speed taps.

In my experience, switches can generally only monitor or mirror one selected
port at a time, for the 
obvious reason stated in this and several other messages.  The only
exception I
know of is the "Secure Switch" made by ODS networks which can, reportedly, 
monitor 10 of it's 12 ports to one monitor (or mirror) port. The reason for
this is
to address the very thing being discussed here.

        ...snip...

        >               Vern

Todd