RE: IPS and Trunking

["Andy Cuff" <lists () securitywizardry com>]

Hi Trav,
Put this together a while back to detail how to do this with a number of
vendor switches
http://www.securitywizardry.com/switch.htm
The advent of switched networks resulted in Network IDS having great
difficulty in promiscuously monitoring their networks. This was overcome by
configuring a switch to replicate the data from all ports or VLAN's onto a
single port.  This function has a multitude of names including; Port
Mirroring, Monitoring Port, Spanning Port, SPAN port and Link Mode port.
Generally Port Mirroring usually indicates the ability to copy the traffic
from a single port to a mirror port but disallows any type of bidirectional
traffic on the port.
Spanning Port usually indicates the ability to copy traffic from all the
ports to a single port but also typically disallows bidirectional traffic on
the port. In the case of Cisco, SPAN stands for Switch Port ANalyzer. Some
switches do not allow SPAN ports to transmit packets, this is an issue if
you wish to use IDS TCP countermeasures such as resets.  It may also be
worth looking at Network Taps which allow you to tap into a network, taking
a parallel feed for the Network IDS

Regards

Andy Cuff
Managing Director / CEO
Computer Network Defence Ltd
www.SecurityWizardry.com
Tel 0870 321 9014
Mob 0701 070 9014
International +44 1225 811777  

> -----Original Message-----
> From: listbounce () securityfocus com 
> [mailto:listbounce () securityfocus com] On Behalf Of trav_2 () hotmail com
> Sent: 08 February 2007 18:04
> To: focus-ids () securityfocus com
> Subject: IPS and Trunking
>
> Cisco has a great feature where I can configure all traffic 
> on a switch to go to a trunk port, plug in the IPS/IDS to the 
> trunk port and see all traffic. Can other vendors, such as 
> Sourcefire, TippingPoint, ISS do this?
>
> Thanks,
>
> --------------------------------------------------------------
> ----------
> Test Your IDS
>
> Is your IDS deployed correctly?
> Find out quickly and easily by testing it with real-world 
> attacks from CORE IMPACT.
> Go to 
> http://www.coresecurity.com/index.php5?module=Form&action=impa
> ct&campaign=intro_sfw
> to learn more.
> --------------------------------------------------------------
> ----------


------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it 
with real-world attacks from CORE IMPACT.
Go to http://www.coresecurity.com/index.php5?module=Form&action=impact&campaign=intro_sfw 
to learn more.
------------------------------------------------------------------------