4
/ ? . Cisco ( ) VLAN (Wireshark, ).
, IDS (Intrusion Detection System) . SPAN/RSPAN, , .
SPAN
SPAN () (source port) (destination port). : SPAN fa 0/1 fa 0/5:
! SPAN ( ).
:
switch# configure terminal switch(config)# monitor session 1 source interface fa0/1 switch(config)# monitor session 1 destination interface fa0/5
, ? fa 0/1 fa 0/5.
: RSPAN
. RSPAN (Remote SPAN). () L2 . VLAN , .
, . : , 1 ( fa 0/1) 2 ( fa 0/5). L2. .
:
// switch_source# config term switch_source(config)# vlan 100 // Remote VLAN ( source ) switch_source(config-vlan)# remote span switch_source(config-vlan)# exit switch_source(config)# monitor session 10 source interface fa0/1 switch_source(config)# monitor session 10 destination remote vlan 100 // switch_remote# config term switch_remote(config)# vlan 100 // Remote VLAN () ( source ) switch_remote(config-vlan)# remote span switch_remote(config-vlan)# exit switch_remote(config)# monitor session 11 source remote vlan 100 switch_remote(config)# monitor session 11 destination interface fa0/5
, fa 0/1 () vlan 100, , (remote) 100 VLAN fa 0/5. .
Party Hard: ERSPAN
ERSPAN (Encapsulated Remote Switched Port Analyzer) - , L3 . GRE .
, GRE ( IP ). , fa 0/1 fa 0/5.
:
// switch_source(config)# monitor session 1 type erspan-source switch_source(config-mon-erspan-src)# source interface fa0/1 switch_source(config-mon-erspan-src)# destination switch_source(config-mon-erspan-src-dst)# erspan-id 111 // switch_source(config-mon-erspan-src-dst)# ip address 192.168.1.5 //IP - switch_source(config-mon-erspan-src-dst)# origin ip address 192.168.2.5 //IP - () // switch_remote(config)# monitor session 1 type erspan-destination switch_remote(config-mon-erspan-dst)# destination interface fa0/5 switch_remote(config-mon-erspan-dst)# source switch_remote(config-mon-erspan-dst-src)# erspan-id 111 switch_remote(config-mon-erspan-dst-src)# ip address 192.168.1.5 //IP - ()
VLAN:
monitor session 1 source vlan 13
:
monitor session 1 source vlan 13 rx/tx
:
show monitor session 1
