Using Advanced Capture Methods

Previous sections described how various methods of capturing traffic work and how each feature is configured on different models of hardware. This section applies configuration tips from earlier to some common cases of IDS installation and also describes the specifics of using either standalone IDS or Catalyst IDS Modules.

We will assume that IDSMs are installed in slots 5 and 6 of the Catalyst 6000 switch, and that the VLANs to be monitored are numbered 100, 200, and so on. Regarding the IDSM, we are generally interested in monitoring only Web traffic using VACLs. For external IDS modules, we assume they are connected to ports 3/1, 3/2, and so on.