Nortel 2050 Installation Manual page 21

Chapter 1: Before you begin
that the detection engine sees every packet on a higher volume network because
of the potential of packet collision. For a simple network with low traffic, this is not
likely to be a problem. In a high-traffic network, a different option may provide
better results.
IMPORTANT! Some devices are marketed as hubs but actually function as
switches and do not broadcast each packet to every port. If you attach your 3D
Sensor to a hub, but do not see all the traffic, you may need to purchase a
different hub or use a switch with a Span port.
Using a span port
Many network switches include a span port that mirrors traffic from one or more
ports. By connecting an interface set to the span port, you can monitor the
combined traffic from all ports, generally both incoming and outgoing. If you
already have a switch that includes this feature on your network, in the proper
location, then you can deploy the detection on multiple segments with little extra
equipment cost beyond the cost of the 3D Sensor. In high-traffic networks, this
solution has its limitations. If the span port can handle 200 Mbps and each of
three mirrored ports can handle up to 100 Mbps, then the span port is likely to
become oversubscribed and drop packets, lowering the effectiveness of the 3D
Sensor.
Using a network tap
Network taps allow you to passively monitor traffic without interrupting the network
flow or changing the network topology. Taps are readily available for different
bandwidths and allow you to analyze both incoming and outgoing packets on a
network segment. Unfortunately, you can only monitor a single network segment
with most taps, so they are not a good solution if you want to monitor, for example,
the traffic on two out of the eight ports on a switch. Instead, you would have to
install the tap between the router and the switch and access the full IP stream to
the switch.
By design, network taps divide incoming and outgoing traffic into two different
streams over two different cables. Most models of the 3D Sensors offer multi-port
options that recombine the two sides of the conversation so that the entire traffic
stream is evaluated by the decoders, the preprocessors, and the detection
engine.
Between a Switch and an Endpoint
When you deploy an inline 3D Sensor between a switch and an endpoint, use a
straight-through cable between the switch and the sensor and a crossover cable
between the sensor and the endpoint.
N TPS 3D S D C I G R 4.7.0 21
ORTEL ENSOR AND EFENSE ENTER NSTALLATION UIDE ELEASE PAGE