1

We're setting up NIDS monitoring and the bosses want to monitor all the ports, but I'm wondering if this actually makes sense.

The switch we're currently using can only mirror 4 source ports to one destination port, so we don't have enough spare ports to monitor all of the currently-used ports.

Would a typical NIDS setup involve monitoring only important ports (VMs, internet port), or is it common to monitor all ports?

If monitoring all ports is standard, what is the best way to do this? Are there 24-port network taps that could connect to all of the switch ports? Are there better switches that will monitor all ports on a single span port?

Thoughts?

2

Port mirroring, while possible even on cheap switches such as the Unmanaged Plus NETGEAR ProSAFE GS105Ev2 or the even better Easy Smart TP-LINK TL-SG108E, is a gamble due to timing and loss. It is very possible to configure a scenario where a long-term-running port mirror can continue to copy frames for months at a time without losing frames. You probably want to use an undersubscribed network with high-end Juniper Networks or Cisco gear, though, with good clocks and/or NTP configuration.

For taps, you can avoid oversubscription and switch max-CPU problems. If the switched network becomes problematic such as a spanning-tree event, you can still capture all of the relevant frames. Port mirroring can also cause a lot of packet de-duplication which may raise the CPU of switches to unwanted levels.

There are many tap vendors with a variety of different layouts and configurations. I suggest that you read this article -- http://packetpushers.net/practical-visibility-fabric-part-1/ -- which mentions the four major players in that space as well as gives plenty of background on how to go about building a visibility fabric, i.e., a place where you can configure a set of monitors such as network intrusion detectors.

An additional suggestion is to monitor and test the performance of your capture infrastructure with a tool such as -- https://github.com/adulau/netbeacon

  • I took a look at some network taps, but they still don't seem to have any with 24 ports. Is it abnormal to set up monitoring for all ports on a switch? – user228546 Feb 10 '16 at 22:05
  • The GigaVUE H and G series are found at network trade shows very often -- and they definitely support that requirement. It's not abnormal especially if you work in Technical Marketing Engineering for Ethernet switches ;> – atdre Feb 10 '16 at 22:38
  • It seems like those are mostly for fibre - we're just using regular copper ethernet. – user228546 Feb 10 '16 at 23:02
  • SFPs with copper should suffice, albeit overkill – atdre Feb 10 '16 at 23:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.