What to monitor if there are several VLANs 1

[CELE1]

We have a Cisco network environment where are configured 4 VLANs.
We are using Sniffer 4.60, and I'm doing a mirror from the main VLAN in one of the ports from thecore switch (a Catalyst 6509).
My question is, what should we monitor or mirror to know the utilisation of the LAN bw, or let's say, if I just mirror one of the VLAN's, sniffers reports an average utilisation but, is this just for that VLAN or is that number also for all the Switch utilisation.

Any sugestion on how to put to configure my sniffer ?

Thanks

 

[jrsavage]

The utilization you see is for the port that you have sniffer connected to. Not the switch or the VLAN.

JRSavage.

 

[wybnormal]

Not exactly.. if you *mirror* or *span* a VLAN to a port on the Cisco switch, you in fact see the traffic of the VLAN.. within some limits.. ie.. you see VLAN traffic on THAT switch plus any broadcast traffic for the entire VLAN.. with a 100Meg connection you can and probably will drop packets. Full duplex sniffing gets into some real fun with trying to catch everything.

Cisco will also let you mirror all the vlans on the one port but it's really not recommended. Spanning tree loops are not fun and you need to fully understand what you think you are going to be doing.

The book from Syngress for the NAI Sniffer has some nice tips and guidelines to follow regarding this.

MikeS
Find me at

http://www.packetattack.com

"Take advantage of the enemy's unreadiness, make your way by unexpected routes, and attack unguarded spots."
Sun Tzu