Google Groups no longer supports new Usenet posts or subscriptions. Historical content remains viewable.
Dismiss

Checking packet statistics on monitored session port

1 view
Skip to first unread message

Stephen Reese

unread,
Oct 9, 2008, 6:23:58 PM10/9/08
to
I would like to verify that I'm not dropping packets on a port that I
am monitoring with a IDS.

What would be the best way to do this? Is there a command to run to
determine the current statistics?

Will SNMP or logging send alerts if a port that is being mirrored
loses packets or buffering is exhausted?

monitor session 1 source interface Fa0/1
monitor session 1 destination interface Fa0/3

Thanks

Thrill5

unread,
Oct 9, 2008, 8:21:52 PM10/9/08
to
show interface fa 0/3

You can poll the interface statistics using SNMP

Odds are low that you would drop packets from a monitoring session. Even if
a few were dropped, what difference would it make? During spikes in
traffic, its more likely that the IDS would drop the packets then the
switch. If you are really concerned about it you should use a tap between
the device and the switch instead of using SPAN.

"Stephen Reese" <rsr...@gmail.com> wrote in message
news:1d321adf-fd2d-4251...@a29g2000pra.googlegroups.com...

Stephen Reese

unread,
Oct 9, 2008, 11:47:28 PM10/9/08
to
> You can poll the interface statistics using SNMP
>
> Odds are low that you would drop packets from a monitoring session. Even if
> a few were dropped, what difference would it make?  During spikes in
> traffic, its more likely that the IDS would drop the packets then the
> switch.  If you are really concerned about it you should use a tap between
> the device and the switch instead of using SPAN.

I didn't think there would be any loss especially since the links are
pretty low throughput but I just wanted to ask. Thanks for the SNMP
tip.

0 new messages