Full-Duplex And Half-Duplex Monitoring; Deploying Sensors In In-Line Mode - McAfee M-1250 - Network Security Platform Deployment Manual

McAfee® Network Security Platform 6.0

Full-duplex and half-duplex monitoring

Sensors are equipped with multiple Monitoring and Response ports. By default, the Sensor
ports are internally wire matched (that is, 1A and 1B) to monitor traffic in full-duplex pairs,
that is, two detection ports work together to monitor traffic flowing in both directions.
To monitor a full-duplex segment in In-line or Tap mode, you use two Sensor ports (one
port for transmit, one for receive). SPAN port monitoring receives on one port and can
respond via the same port (if the switch supports this feature).
I-1200
I-1400
I-2700
I-3000
I-4000
I-4010
M-8000
M-6050
M-4050
M-3050
M-2750
M-1450
M-1250
N-450




Deploying Sensors in in-line mode

In-line mode is achieved when the Sensor is placed directly in the path of a network
segment, becoming, essentially, a "bump in the wire," with packets flowing through the
Sensor. In this mode, the Sensor can prevent network attacks by dropping malicious traffic
in real time. Preventative actions can be at a highly granular level, including the automated
dropping of DoS traffic intended for a specific Web server.
Sensor Model Supported number of
full-duplex links
1
2
4
6
2
6
Sensor Model Supported number of
full-duplex links
28
16
12
12
20
8
8
20
In-line mode and tap mode can both monitor full-duplex links.
SPAN monitoring works in either half- or full-duplex mode (depending on the switch).
Hub monitoring works in half-duplex mode.
Supported number
of half-duplex links
2
4
8
12
4
12
Supported number
of half-duplex links
16
8
8
8
20
8
8
20
15
Sensor Deployment Modes