Re: Cisco Catalyst - SNORT

[Gary Flynn <flynngn () jmu edu>]

Jeff Nathan wrote:


> But wait, it gets better.  Imagine having to copy that many frames from an 
> ordinary switch port to a SPAN port.  Two point eight million frames per 
> second!
>
> I'm sure some Ethernet switches mirror traffic very well, but upon further 
> investigation I believe it would be stretching the truth to say there is no 
> performance degradation in doing so.


I'm not saying the switch works this way but if the packets are on a bus
and configuring a span port just means telling the port to grab anything
on the bus, it would seem there would be no performance hit.

--
Gary Flynn
Security Engineer - Technical Services
James Madison University

Please R.U.N.S.A.F.E.
http://www.jmu.edu/computing/runsafe



-------------------------------------------------------
This SF.Net email is sponsored by: INetU
Attention Web Developers & Consultants: Become An INetU Hosting Partner.
Refer Dedicated Servers. We Manage Them. You Get 10% Monthly Commission!
INetU Dedicated Managed Hosting http://www.inetu.net/partner/index.php
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users