Cisco Monitoring Problem

Hey here what i need to do :)

I have Cisco Catalist 2950 and i have more then 200 PC's i have one SERVER special added in the switch just to Monitor all trafic which is send to my PIX which is added in the switch in.
i use Ethernal for monitoring

when i set monitor on my switch and add the command :
monitor session 1 source interface gigabit0/1
monitor session 1 destination interface fa0/24

My server is getting DAMN CRAZY dosent move and its :

IBM-XSERIES_364
Intel(R) Xnenon(TM) 3.60GHZ
with 3Giga RAM

i really dont understande why my Server crashes
munemgumenAsked:
Who is Participating?
 
atyarCommented:
Ok - so if I understand correctly, the pix is on port 11, and the monitoring server is on port 16.  
1)Setup port mirroring so that port 11traffic  is mirrored to port 16
2)Configure ethereal on the monitoring server to sniff traffic bound for the pix's ip address.

That should do it.
0
 
atyarCommented:
What is connected to your gigabit 0/1 interface - if it's an uplink to another switch, that's not the interface you'd want to select.  I've done this before, using wireshark (ethereal's current iteration), by mirroring the switchport that the pix is connected to to the switchport the wireshark monitoring server is connected to.  Also, configure ethereal/wireshark to monitor traffic with the destination ip of your pix, so you aren't picking up all the broadcast crap traffic.
0
 
munemgumenAuthor Commented:
So i have just one switch and all goes inside in.

So my pix is on my 11-port and my BACKUPserver is on 16

i fxided up the swhitch with the connamd up and all just ins getting on my Server i dont have even time to set up anything the damn server just BLOCKS.

what do you think ?

regards, Igor
0
KuppingerCole Reviews AlgoSec in Executive Report

Leading analyst firm, KuppingerCole reviews AlgoSec's Security Policy Management Solution, and the security challenges faced by companies today in their Executive View report.

 
atyarCommented:
I don't quite understand what you're saying in your last post.
It sounds like you're saying this 'backupserver' is on a different switch (16-port) than the pix (11-port), but you start by saying 'So I have just one switch....'.  Is it 1 switch with vlans - is that what you mean?
0
 
munemgumenAuthor Commented:
i have Switch Cisco Catalyst 2950

I have the PIX on the other side which is connected to this PIX and its on port 11.
all other subnetworks are connected to this mail Switch i had one more free port on this switch and i added an special server there just so i monitor all traffic on port 11

there i think you can understande me now.
0
 
Computer101Commented:
Forced accept.

Computer101
EE Admin
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.