Duplicating a span port (copper tap?)

[billmatthews]

We have a Cisco 3750 that has a span port setup, to mirror traffic from all the other ports.  Right now we have our IDS connected to that span port.  But we now have a need to have a second device see that same traffic.  In the old 10/100 days we could probably have used a hub.

But in a gigabit world, how do I let two devices see that span traffic?  I found some gigabit taps, but they seemed to be designed to sit inline between two devices, not necessary to just duplicate a single port (which would come from my SPAN). But maybe they would work anyway?

http://www.blackbox.com/Store/Detail.aspx/10-100-1000-Copper-Aggregator-Tap-256-MB-Buffer/TS254A

[s.marino]

Please refer to the link below.

http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/catos/8.x/configuration/guide/span.html#wp1019981

Regards,

Sal

[billmatthews]

Hi Sal,

Thanks!  But I'm already familar with how to setup a SPAN port.  We've got one setup and running just fine now.  But we're looking to take that single SPAN port and get the traffic to two hosts.

I realize I could setup two SPAN ports, but we're running low on physical ports on our switch.  So I'm looking for advice on hardware to "split" the SPAN port into two devices.

[Giuseppe Larosa]

Hello Bill,

you could add another switch to move some users there so that you can add a second SPAN destination port.

This looks like more useful on the long term.

Taps are usually proposed as alternative to SPAN sessions.

Be aware that spanning all ports to a single GE can cause problems: some traffic can be lost and switch cpu usage can become high when there is high  oversubscription of the destination port(s).

Hope to help

Giuseppe