I would like to verify that I'm not dropping packets on a port that I am monitoring with a IDS.
What would be the best way to do this? Is there a command to run to determine the current statistics?
Will SNMP or logging send alerts if a port that is being mirrored loses packets or buffering is exhausted?
monitor session 1 source interface Fa0/1 monitor session 1 destination interface Fa0/3
Thanks
show interface fa 0/3
You can poll the interface statistics using SNMP
Odds are low that you would drop packets from a monitoring session. Even if a few were dropped, what difference would it make? During spikes in traffic, its more likely that the IDS would drop the packets then the switch. If you are really concerned about it you should use a tap between the device and the switch instead of using SPAN.
I didn't think there would be any loss especially since the links are pretty low throughput but I just wanted to ask. Thanks for the SNMP tip.
Have something to add? Share your thoughts — no account required.
Ask the community — no account required