North American Network Operators Group|
Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical
Re: Techniques for passive traffic capturing
Ross Vandegrift <ross <at> kallisti.us> writes: > > On Tue, Jun 24, 2008 at 01:19:03PM +1200, Nathan Ward wrote: > > I see little point in aggregating tapped traffic, unless you have only > > a small amount of it and you're doing it to save cost on monitoring > > network interfaces - but is that saved cost still a saving when you > > factor in the cost of the extra 3750s in the middle? I'd guess no. > > Thanks for all the info Nathan - lots of good leads in your email. > Let me include some more information. > > The problem is finding a way to multiplex that traffic from the > optical tap to multiple things that want to peek at it. The > remote-span trick solves that, as well as integrating media > converters. 3750 is nice since you can stack em up and mix/match the > SFP and copper ports. > http://www.gigamon.com. Taps+MultiPlexing+Filtering+Clustering+10g. I've been using them very successfully for exactly what you describe for the last 2 years. If they are a bit too pricey, look at http://www.vssmonitoring.com. Similar capabilities to Gigamon, slightly less flexibility (fixed hardware configurations vs Gigamon's modular configuration) and possibly cheaper depending on your needs.