DMZ for logging

Il 31/01/2012 16:28, Harry Putnam ha scritto:
> Two people have mentioned `mirroring' a port. What does it actually
> mean and how would it look in a diagram? Just a text style rough idea.

A simple schematic:

WAN (ISP)
|
|
Ethernet Switch
|
|
Router/Firewall


If you have this situation (and you have a decent switch), you can
reconfigure your switch to "mirror" a port, eg. copy everything from
port X to Y. So:

WAN (ISP)
|
|
Ethernet Switch
X/ \Y
/ \
Router/FW Logging Server


Most switches have the capability to stop incoming traffic from mirrored
Y port, so your logging server will be passive.

In this case the switch literally do a raw copy of packets that are
incoming/outgoing over port X to port Y, just like you're watching the
traffic flow directly into the cable.

How configure that depends on your switch.

PS: sorry for my bad english.

Enrico