SPAN from 10G wan link with little traffic to 1G interface. Will it work ?

[mateens]

SPAN from 10G WAN link with little traffic to 1G interface. Will it work ?

[Mark Malone · Accepted solution]

Hi

what platform/model  is this on ?

if its nx-os you can rate limit your span , either way once your traffic is under a GB you should be fine , you don't want to overload the interface

Configuring the Rate Limit for SPAN Traffic

By configuring a rate limit for SPAN traffic to 1Gbps across the entire monitor session, you can avoid impacting the monitored production traffic.

On Nexus 5000 series switches:

• When spanning more than 1Gbps to a 1 Gb SPAN destination interface, SPAN source traffic will not drop.

• When spanning more than 6 Gbps (but less than 10Gbps) to a 10Gb SPAN destination interface, the SPAN traffic is limited to 1Gbps even though the destination/sniffer is capable of 10Gbps.

SUMMARY STEPS

1.    switch# configure terminal

2.    switch(config)# interface ethernet slot/port

3.    switch(config-if)# switchport monitor rate-limit 1G

4.    switch(config-if)# exit

[mateens]

Hi,

Its a Cisco 6509-E. I want to install an IDS server and mirror the in/out traffic to it. Since the traffic does not exceed 200-300MBs I do not want to use the last 10G interface as the destination of the SPAN. 

[Mark Malone · Accepted solution]

Hi that's fine with that kind of volume of span to a GB port you shouldn't face any issues

[mateens]

Thanks for the reply.

I have one more question regarding SPAN. My main focus is to detect spams and viruses on the Employee VLAN.(We have server,student,guest and print VLANs too)

Would that traffic be detectable with my SPAN config stated above or should I use only the Employee VLAN int. as the source of the SPAN ?

Lets put it this way, Im confused about the  basic concept of how the traffic looks like when it leaves a vlan and routed out to the internet.

[Mark Malone]

That depends on your IDS system it should see something

So we span everything for security reasons but we use certain devices/hardware and software for different tasks

We use a bluecoat to detect any issues going outbound to the web for protection

We use DLPs to review SPAN traffic and other software that can inspect individual SPAN packets, the thing with security is there is no one fix all product , you need to use layers of devices that specialise in certain functions , especially when trying to track viruses but IDS is a very good start

SNORT is an open source tool which is very good at tracking viruses too

having host level scanners inbuilt to your machines will also help especially when capturing that data  

if the IDS can take it I would collect as much traffic as possible from each vlan , don't think printer vlan would be required really but student and guest I would capture too