2 VLAN's on 1 Port SPAN - CIsco 6500

Beth,

It's definitely possible to have multiple VLANs as a source. But like you said, you have to be careful not to oversubscribe or you'll miss some data due to queue drops (or worse, spike the CPU).

HTH, neteng

No need to worry about spiking the CPU, the 6500 doesn't use the CPU to switch packets or to mirror ports. It's more likely that the IDS will get overloaded long before the 6500 starts dropping packets because of an oversubscribed GIG interface.

In the interest of planning ahead - you may need to look into "VACLs". If you ever need a 3rd session...that is a decent solution.

Good point. Thanks Thrill5.

neteng

Thanks, I've seen some stuff on VACL's. So I can use a VACL to capture and filtered traffic? In this case it would need to be all traffic on VLAN1. Could you give me an example of how I could capture VLAN1 traffic and send that the a port where I have the collector/ sniffer?

Beth

Thanks, I've seen some stuff on VACL's. So I can use a VACL to capture and filtered traffic? In this case it would need to be all traffic on VLAN1. Could you give me an example of how I could capture VLAN1 traffic and send that the a port where I have the collector/ sniffer?

Beth

All you need to know and then some!

some!