Here's my dilemma. We currently have 2 span sessions created on our core switch 6509, one for an IDS and the other for a websense server. I currently only have 1 vlan configured but that will change. We have 20+ edge switches and branch locations. We just invested in a Sniffer. If we still want to keep these other two span sessions, what other options do I have?
Options presented: 1. Purchase a tap. Seems expensive
2. I read that I could set up a span session on a switch and have the traffic routed. Is this possible?
3. Take off the IDS and put in the sniffer.
Thanks for the help.
Sean
