Re: [uml-user] How to configure Port mirroring on UML

[Blaisorblade <bla...@ya...>]

On Tuesday 02 January 2007 20:29, Brock, Anthony - NET wrote:
> > -----Original Message-----
> >
> > On Tue, Jan 02, 2007 at 06:48:05PM +0530, Praveen Lobo wrote:
> > > I have configured a switch in one of the UMLs (switch0). I
> >
> > have two UML's
> >
> > > (pc0 and pc1 ) communicating through the switch (switch0).
> >
> > Now I want
> >
> > > configure port mirroring on the switch. I would like to
> >
> > know whether such
> >
> > > configuration is possible or not. If yes, please let me
> >
> > know the steps.
> >
> > What's port mirroring?
>
> Jeff,
>
> Without knowing for certain, he is most likely trying to build the
> equivalent of a SPAN port or (Cisco) VSPAN.
>
> This is frequently used in networking to monitor traffic passing through
> arbitrary ports of a network switch. For example, my work uses this type
> of connection to monitor all traffic to/from our wireless network. Once
> configured on the network switch, we direct the SPAN traffic to a
> monitoring box that can perform traffic analysis and anomaly detection
> on everything passing through the specificied ports on the switch. This
> has helped us identify the causes of network outages, identify rogue
> DHCP servers, and monitor attempted compromises of our network as they
> occurred.
>
> In other words, it's a fancy form of network tap that can be placed
> simultaneously on multiple ports. While historically this wasn't needed,
> the widespread adoption of switches in place of hubs has made it a
> necessity for many forms of network remediation and monitoring. I would
> consider this a low priority, but it could be very helpful to have.
>
> Tony
uml_switch allows running in -hub mode. Now, cascading two different 
uml_switch'es would do the job. It would be easy to do (if you do not expect 
them to support Bridge Spanning Trees), and there are two or three different 
reimplementations of uml_switch, and I suppose that at least one of them 
could support this.
-- 
Inform me of my mistakes, so I can add them to my list!
Paolo Giarrusso, aka Blaisorblade
http://www.user-mode-linux.org/~blaisorblade
Chiacchiera con i tuoi amici in tempo reale! 
 http://it.yahoo.com/mail_it/foot/*http://it.messenger.yahoo.com