Version 5.2
Sourcefire 3D System Installation Guide
33
Understanding Deployment
Connecting Devices to Your Network
Chapter 2
Using a Hub
An Ethernet hub is a simple way to ensure that the managed device can see all
the traffic on a network segment. Most hubs of this type take the IP traffic meant
for any of the hosts on the segment and broadcast it to all the devices connected
to the hub. Connect the interface set to the hub to monitor all incoming and
outgoing traffic on the segment. Using a hub does not guarantee that the
detection engine sees every packet on a higher volume network because of the
potential of packet collision. For a simple network with low traffic, this is not likely
to be a problem. In a high-traffic network, a different option may provide better
results. Note that if the hub fails or loses power, the network connection is
broken. In a simple network, the network would be down.
Some devices are marketed as hubs but actually function as switches and do not
broadcast each packet to every port. If you attach your managed device to a hub,
but do not see all the traffic, you may need to purchase a different hub or use a
switch with a Span port.
Using a Span Port
Many network switches include a span port that mirrors traffic from one or more
ports. By connecting an interface set to the span port, you can monitor the
combined traffic from all ports, generally both incoming and outgoing. If you
already have a switch that includes this feature on your network, in the proper
location, then you can deploy the detection on multiple segments with little extra
equipment cost beyond the cost of the managed device. In high-traffic networks,
this solution has its limitations. If the span port can handle 200Mbps and each of
three mirrored ports can handle up to 100Mbps, then the span port is likely to
become oversubscribed and drop packets, lowering the effectiveness of the
managed device.
Using a Network Tap
Network taps allow you to passively monitor traffic without interrupting the
network flow or changing the network topology. Taps are readily available for
different bandwidths and allow you to analyze both incoming and outgoing
packets on a network segment. Because you can monitor only a single network
segment with most taps, they are not a good solution if you want to monitor the
traffic on two of the eight ports on a switch. Instead, you would install the tap
between the router and the switch and access the full IP stream to the switch.
By design, network taps divide incoming and outgoing traffic into two different
streams over two different cables. Managed devices offer multi-port options that
recombine the two sides of the conversation so that the entire traffic stream is
evaluated by the decoders, the preprocessors, and the detection engine.
