Moitoring 2 switches which span port enabled

[banalas]

I have to switches 6509 and 5000 both have a span port on them how can i monitor the traffic from both switches , can i do connecting to switches to a switch and connect my monitoring station to that switch, will i be able to do that or is there any different way

Please help

Thanks

 

[gunthnp]

two nics each nic is on a mirroed port for each switch and use aetherpeak or something

gunthnp from

http://wwww.advancedigitalsolutions.com

 

[inetworku]

I would consider looking at spanning on an aggregation point. Do you have these two switches connected together? Do they share a common vlan (ie vlan1) which contains the traffic you're intersted in? You can span 1 or more vlans but could get pretty busy for your network management station. Realize that monitoring the traffic from two large switches such as these could generate a tremendous amount of data. Can you simplify the traffic you're interested in by narrowing down on the application, hosts or specific segments?

 

[lgarner]

I have what looks like the same scenario. I'd like to hear from inetworku on how this might work. From my reading, I can mirror several ports to a monitor port on a switch, but I can't see how to monitor several ports on two switches from a single monitor port. I've been considering the obvious- gunthnp's idea of having the IDS sit on both switches.

I have two C2950T-24's connected together by the two gig ports using etherchannel. 12 ports on each switch are on the vlan that I want to watch. The IDS monitor NIC is currently plugged into port 24 on switch 1. I can see this being tricky since all traffic (including 3 other vlans) goes through the etherchannel port. Gunthnp's suggestion is probably the simplest, but I'd like to know if this is possible.

 

[lui3]

you can also try rspan if the feature is available on both switches. you can configure two different monitoring sessions on one switch and one of them can monitor local ports and the other can monitor remote ports. once again the ios/cos images must support it.

http://www.cisco.com

search for remote spanning or remote span