Hardware capture platforms

Thu Jul 31 15:00:36 UTC 2008

On 31 Jul 2008, at 14:16, Juuso Lehtinen wrote:

> Second that.
>
> Using hub to tap into a single link is also risky. I used to monitor  
> single FE link with 100M hub. After link had moderate utilization  
> >20%, collision led was lit all the time.
>
> I've had good experience with VSS Monitoring Ethernet Aggregator  
> taps. Also Catalyst 2960 SPAN seems to work OK.
>
> As for capture PC, we've been using regular PC with Wireshark.  
> That's good for single FE link, but has problem with GE and multiple  
> links.

If you need to increase the speed of your capture tool, maybe this [1]  
link may be of use.
It is an implementation of a libpcap that implements a shared memory  
ring buffer which can result in some capture performance gains.

[1] http://public.lanl.gov/cpw/

-Leon

> BR,
>  Juuso
>
> On Wed, Jul 30, 2008 at 4:26 PM, Leon Ward <seclists at rm-rf.co.uk>  
> wrote:
>
> On 30 Jul 2008, at 03:26, James Pleger wrote:
>
> Something you might want to look into is traffic aggregation with a
> switch or hub. You can buy an Allied Telesyn switch and basically turn
> it into a hub by disabling switchport learning. Just an idea.
>
> Never try to aggregate multiple TAPs with a hub.
> You will just create a bucket load of collisions and end up with a  
> useless data feed presented to your monitoring tool. If you want to  
> aggregate multiple TAP feeds into a smaller number of devices(s),  
> most of the TAP vendors make some form of link aggregation device.
>
> Or, depending on the OS and sniffer you use, you may be able to bond  
> the interfaces on the capture device.
>
> -Leon
>
>
>
>
> You can use regular old tcpdump with the -C option to rotate logs
>
> tcpdump -i blah -s0 -C <filesize to rotate>, etc.
>
> or you can use Daemonlogger which does pretty much the same thing...
>
> http://www.snort.org/users/roesch/Site/Daemonlogger/Daemonlogger.html
>
>
>