Not sure what you mean by one nic monitoring and one nic in stealth
mode. Usually your monitoring nic should be the one in stealth mode.
Maybe you meant one management nic and one monitoring (stealth) nic.
Anyway on a Cisco 3550 when you setup a SPAN port you must enter the
below command to allow the SPAN port to except spoofed RSKILL packets
back in the SPAN port.
incoming packet enable
or
inc pac ena
in the SPAN properties will enable you to monitor and do TCP resets
from the same cable back into the SPAN port and injected back into the
network.
Hope that helps.
DMZSecure
On Tue, 22 Mar 2005 17:15:42 -0300, Paula Rodrigues - daydreams
<daydreams@ig.com.br> wrote:
Hi ,
I have a sensor that monitor my DMZ , and I have only two NIC's and my
switch is a 3550.
I use one Nic to monitoring and the other in "stealth" mode . Can I send
RSKILL through the port span of the switch 3550?
Thanks a lot !
M.Eduarda
_______________________________________________
ISSForum mailing list
ISSForum@iss.net
TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to
https://atla-mm1.iss.net/mailman/listinfo/issforum
To contact the ISSForum Moderator, send email to mod-issforum@iss.net
The ISSForum mailing list is hosted and managed by Internet Security Systems,
6303 Barfield Road, Atlanta, Georgia, USA 30328.
_______________________________________________
ISSForum mailing list
ISSForum@iss.net
TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to
https://atla-mm1.iss.net/mailman/listinfo/issforum
To contact the ISSForum Moderator, send email to mod-issforum@iss.net
The ISSForum mailing list is hosted and managed by Internet Security Systems,
6303 Barfield Road, Atlanta, Georgia, USA 30328.
