Based on your experiences, which do you prefer? SPAN seems to expose alot of false positive traffic, but will VACL not expose enough?

Webtrends is lame and what we are currently using. What do you recommend and why?Thanks.

I have just moved into a new company at the Manager for Security and Operations. We have a CIDS for the 6500 switch installed, but not configured or activated. According to my reports, the system is overwelling them, and they are not able to tackle...