sys admin network monitor

[Bob Chiodini]

On Mon, 2004-02-09 at 08:30, redhat wrote:
> I am looking for an open source piece of software that will monitor all
> of our LAN traffic.  I have a Cisco 3550 that handles our LAN and can
> turn on port mirroring to monitor everything going out our router - at
> least that is what I was told I had to do.  

As an aside:  Port mirroring may create a bottleneck in the 3550.  You
cannot physically push the entire switch's traffic out of single port
without slowing something down, or dropping packets.  I think port
mirroring is typically intended for troubleshooting, not permanent
monitoring.

If you want to monitor only traffic passing through the 3550, you may do
well to place a dumb hub (i.e. not a switch) at the 3550's upstream
interface and monitor the traffic there, but this will not provide any
port-to-port monitoring.

Bob...