-
Network Management Station
The administrator
-
MIB
tracks of the interface of errors how many packets
-
management network
that provides the interconnection between managing systems and the managed systems
-
production network
the traffic of subscribers and end users
-
Out of band connection
no user traffic on this
-
Dedicated Management Network
- Advantages
- –Reliability
- –Interference avoidance
- –Ease of network planning
- –Security
- •Disadvantages
- –Cost and overhead
- –No reasonable alternative (DSL
- line, for example)
-
Network monitoring and alerting
is that the staff or someone else looking at the network
-
Audit
what users are doing
-
Network Operations Center (NOC)
- The place from which large networks are managed
- May or may not house the communications
- equipment itself
-
Packet-level detail
- Seeing too many errors on an interface
- Pc might be sending out bad frames
-
Monitoring from a switch
You will not always see what some one else will see on their comps
-
LOCAL SPAN SESSION
- bidirectionaltraffic is mirrored from source Gigabit Ethernet port 1 to destination GigabitEthernet port 2, retaining the encapsulation method.
- Switch(config)# monitor session 1 source interface gigabitethernet0/1
- Switch(config)# monitor session 1 destination interface gigabitethernet0/2 encapsulation replicate
-
REMOTE SPAN (RSPAN)
- supports source ports, source VLANs, and destination ports on different switches, enabling remote monitoring of multiple switches across your network.
- The RSPAN traffic from the source ports or VLANs is copied into the RSPAN VLAN and forwarded over trunk ports
-
Remote Span
- shows how to create
- RSPAN VLAN 901.
- –Switch(config)# vlan 901
- –Switch(config-vlan)# remote span
- –Switch(config-vlan)# end
- My switch and any one associated with
- that route
-
RSPAN SOURCE SESSION
- remove any existing RSPAN configuration for session 1, configure RSPAN session 1 to monitor multiple source interfaces, and configure the destination as RSPAN VLAN
- 901.
- –Switch(config)# no monitor session 1
- –Switch(config)# monitor session 1 source interface gigabitethernet0/1 tx
- –Switch(config)# monitor session 1 source interface gigabitethernet0/2 rx
- Switch(config)# monitor session 1 source interface port-channel 2
- Switch(config)# monitor session 1 destination remote vlan 901
- –Switch(config)# end
-
Wireshark
- Free Protocol Analyzer
- Collects packets as they pass by your NIC
- Can collect everything
-
Capture Filter
only collect items that match particular criteria
-
-
span command
- You will see all the traffic to and from the port
- The user cannot detect it
-
Display Filters Combining Two Tests
- and, or
- Both tests must be TRUE for the result to be TRUE and the packet to be kept
- or
- If either test is TRUE, the result is TRUE and the packet will be kept
|
|
