{"id":3817,"date":"2018-11-09T14:09:34","date_gmt":"2018-11-09T13:09:34","guid":{"rendered":"http:\/\/nil2.kis.fri.uniza.sk\/?p=3817"},"modified":"2019-05-17T14:31:42","modified_gmt":"2019-05-17T12:31:42","slug":"span","status":"publish","type":"post","link":"https:\/\/nil.uniza.sk\/en\/span\/","title":{"rendered":"Port-Mirroring"},"content":{"rendered":"

<\/a>Port-Mirroring<\/h2>\n

Port mirroring is used on a network switch to send a copy of network packets seen on one switch port (or an entire VLAN) to a network monitoring connection on another switch port. This is commonly used for network appliances that require monitoring of network traffic such as an intrusion detection system, passive probe or real user monitoring (RUM) technology that is used to support application performance management (APM).<\/p>\n

In our particular case, the faculty provided us with a Cisco Catalyst 2960 switch. We have configured this switch to mirror all internet-bound data traffic traversing the interface connected to network gateway, to the interface connected to Moloch server. As a result, we can now monitor all inbound and outbound lab traffic.<\/p>\n

Switch(config)#monitor session 1 source fa0\/1 both  \n<\/code><\/pre>\n
\u2013 This command specifies source interface as fa 0\/1<\/strong>. The parameter \u201cboth\u201d specifies both directions to be monitored.<\/p>\n
Switch(config)#monitor session 1 destination interface fa0\/24 \n<\/code><\/pre>\n
\u2013 This command defines the destination interface of mirrored traffic<\/p>\n
\"Port-Mirror\"<\/p>\n
<\/a>Sources<\/h3>\n