Re: Hub recommendations

[Matt Van Mater <matt.vanmater () gmail com>]

> Dump the hub approach and go get another cisco switch. Even an old
> Cisco 2924XML has the capability of multiple port mirrors; use all
> the time.

This is one option I was looking for, but all the cisco gear I had
been looking at only supported one destination port for a SPAN
session.  If I read your response correctly, I should be able to
configure multiple ports as the desination for a SPAN session with
this hardware.  This is pretty much what I had been looking for but
with no sucess, thanks.

I agree with what you said about snort being the bottleneck in this
equation, and I don't think my setup will approach that bottleneck any
time soon.

I think the netoptics method would be a good approach to have multiple
feeds go into one of their spyder switches and from there into a
regeneration device, but I was hoping for a single box solution.  Not
to mention that these specialized devices are sure to be many times
the cost of the cisco gear.  I think when we get somewhat larger in
the future we may have to go this route, but right now it might be
overkill.

Any additional comments or insight would be appreciated.


-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now. 
http://productguide.itmanagersjournal.com/
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users