Go Premium for a chance to win a PS4. Enter to Win

x
?
Solved

Looking for a switch to do VLAN mirroring or port mirroring with several ports

Posted on 2013-06-13
8
Medium Priority
?
795 Views
Last Modified: 2016-11-23
Hello All,
We are looking at a product called LANGuardian. It's an agentless software that will allow us to track network traffic. The way it work is with port mirroring. My "gotcha" if you will, is that I have several physical servers that I would like to mirror as well, especially our shared storage. Currently we use Dell PowerConnect switches. They only allow for up to 4 source ports. I would probably need close to 30, maybe more. Someone mentioned to me Cisco Catalyst, HP or 3Com. I am not familiar with them so I am in the dark and was hoping someone else has done something similar and can recommend a switch that will do what I need. I've also been told that VLAN mirroring should work but I'm getting different explanations on what that really is.
0
Comment
Question by:msidnam
  • 4
  • 3
8 Comments
 
LVL 17

Expert Comment

by:max_the_king
ID: 39244655
Hi,
I use cisco catalyst to do this, although i do not use LANGuardian (i use CAPSA) and it works really well.
Here is a link with full explanation

http://www.cisco.com/en/US/docs/switches/lan/catalyst2960/software/release/12.2_55_se/configuration/guide/swspan.html

also, be aware that cisco models will vary on price if you want gigabit (1000) ports or FastEthernet ports (10/100).

hope this helps
max
0
 
LVL 2

Author Comment

by:msidnam
ID: 39245538
Thank you. do you monitor several ports on one switch or do you use the VLAN mirroring?
0
 
LVL 7

Expert Comment

by:unfragmented
ID: 39246431
I see mirroring (SPAN) on a switch as a secondary function, and not something a switch was designed to do.  I suspect thats why many switches are limited to only a few concurrent mirroring sessions.

If you need to monitor a large number of ports, you may want to consider network taps instead, which obviously do not impact the network switch.
0
Independent Software Vendors: We Want Your Opinion

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 
LVL 17

Expert Comment

by:max_the_king
ID: 39246900
Hi msidnam,
i monitor all the ports of the switch through the one that i choose to redirect the mirror, and i even span across multiple switches.
Basically you need to choose one port tht listens to all the others and send the results to the software that analyzes the traffic, in your case LANGuardian. Please note that when you do a mirror of the port, that port is really not accessible on the network, because it just listens to all the traffic: this means, in other words, that you can reach the LANGuardian machine only on its console, and not by any other means (rdp, remote access, and the like).

hope this helps
max
0
 
LVL 2

Author Comment

by:msidnam
ID: 39249155
I have a demo of the LANGuardian working, it just seems that if i need to monitor more than 4 physical servers i may have issues.
0
 
LVL 17

Expert Comment

by:max_the_king
ID: 39255988
Hi,
this is from languardian website:
http://www.netfort.com/languardian/architecture
it seems you shouldn't have problems on mirroring multiple ports.
It may be a limitation of your trial version.

Port monitoring
back to top Most network core switches have the ability to copy network traffic from one port on the switch to another. This feature, which is called port monitoring or port mirroring, enables LANGuardian to capture traffic data for analysis.

Port monitoring is given different names by different switch vendors:

    On a Cisco Systems switch, port monitoring is called Switched Port Analyzer (SPAN). You will often see references in the documentation to a SPAN port.
    On 3Com switches, it is called a Roving Analysis Port (RAP).
    The documentation for HP switches uses the term trunk monitoring.

Configuring a monitoring port on your switch involves the following steps:

    Identify an unused switch port to designate as a monitoring port for LANGuardian.
    Identify the switch ports you want to monitor (these are often called source ports).
    Configure the switch to associate the source ports with the monitoring port.

The switch will send a copy to the monitoring port of all data flowing through the source ports. LANGuardian captures the data from the monitoring port for analysis. The actual data itself is not affected and there is no performance impact.

max
0
 
LVL 2

Author Comment

by:msidnam
ID: 39256103
I guess my biggest question is will the cisco catalayst (or another switch) be able to monitor more than 20 ports at a time to one destination port?

I have the LANGuardian configured and working with no problem. However, my Dell 6248P can only monitor 4 ports and i have around 15 or more physical server that i want monitored  including the router which will grab anything on the edge.
0
 
LVL 17

Accepted Solution

by:
max_the_king earned 2000 total points
ID: 39256136
Hi,
yes, you can monitor all the ports you want and mirror their content to the port where the LanGuardian is.
I do it with Colasoft Capsa software and Cisco catalyst 2960G.

max
0

Featured Post

New feature and membership benefit!

New feature! Upgrade and increase expert visibility of your issues with Priority Questions.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Let’s face it: one of the reasons your organization chose a SaaS solution (whether Microsoft Dynamics 365, Netsuite or SAP) is that it is subscription-based. The upkeep is done. Or so you think.
This article will show you step-by-step instructions to build your own NTP CentOS server.  The network diagram shows the best practice to setup the NTP server farm for redundancy.  This article also serves as your NTP server documentation.
Here's a very brief overview of the methods PRTG Network Monitor (https://www.paessler.com/prtg) offers for monitoring bandwidth, to help you decide which methods you´d like to investigate in more detail.  The methods are covered in more detail in o…
Monitoring a network: why having a policy is the best policy? Michael Kulchisky, MCSE, MCSA, MCP, VTSP, VSP, CCSP outlines the enormous benefits of having a policy-based approach when monitoring medium and large networks. Software utilized in this v…

824 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question