Telegram - ?

4

/ ? . Cisco ( ) VLAN (Wireshark, ).

, IDS (Intrusion Detection System) . SPAN/RSPAN, , .


SPAN

SPAN () (source port) (destination port). : SPAN fa 0/1 fa 0/5:

! SPAN ( ).
  SPAN Cisco

:

switch# configure terminal
switch(config)# monitor session 1 source interface fa0/1
switch(config)# monitor session 1 destination interface fa0/5

, ? fa 0/1 fa 0/5.


: RSPAN

. RSPAN (Remote SPAN). () L2 . VLAN , .

, . : , 1 ( fa 0/1) 2 ( fa 0/5). L2. .

 RSPAN Cisco

:

//   

switch_source# config term
switch_source(config)# vlan 100     // Remote VLAN    (      source )
switch_source(config-vlan)# remote span   
switch_source(config-vlan)# exit
switch_source(config)# monitor session 10 source interface fa0/1
switch_source(config)# monitor session 10 destination remote vlan 100

//   

switch_remote# config term
switch_remote(config)# vlan 100 // Remote VLAN   ()  (      source     )
switch_remote(config-vlan)# remote span
switch_remote(config-vlan)# exit
switch_remote(config)# monitor session 11 source remote vlan 100
switch_remote(config)# monitor session 11 destination interface fa0/5 

, fa 0/1 () vlan 100, , (remote) 100 VLAN fa 0/5. .


Party Hard: ERSPAN

ERSPAN (Encapsulated Remote Switched Port Analyzer) - , L3 . GRE .

, GRE ( IP ). , fa 0/1 fa 0/5.

 ERSPAN GRE

:

//   

switch_source(config)# monitor session 1 type erspan-source
switch_source(config-mon-erspan-src)# source interface fa0/1
switch_source(config-mon-erspan-src)# destination
switch_source(config-mon-erspan-src-dst)# erspan-id 111 //       
switch_source(config-mon-erspan-src-dst)# ip address 192.168.1.5 //IP -   
switch_source(config-mon-erspan-src-dst)# origin ip address 192.168.2.5 //IP -    ()

//   

switch_remote(config)# monitor session 1 type erspan-destination
switch_remote(config-mon-erspan-dst)# destination interface fa0/5
switch_remote(config-mon-erspan-dst)# source
switch_remote(config-mon-erspan-dst-src)# erspan-id 111
switch_remote(config-mon-erspan-dst-src)# ip address 192.168.2.5 //IP -    () 

VLAN:

monitor session 1 source vlan 13

:

monitor session 1 source vlan 13 rx/tx

:

show monitor session 1

?


: